Office (OLE) malware analysis — malicious · e4a749fae7c01a24

MALICIOUS

Office (OLE)

1.02 MB Created: 2017-09-19 07:25:00 Authoring application: Microsoft Office Word First seen: 2020-02-04

MD5: 3887d1bdd8a5986c7662e216eeebada4 SHA-1: 8e5dca4afcdb9e043c9369b05da76b22e80d8260 SHA-256: e4a749fae7c01a24d562e4f19b14a0cfb454eabf821354f45e90a233e622f8b7

270 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a Microsoft Office document containing a malicious VBA macro. The macro is obfuscated and uses `CreateObject` and `Shell()` calls, indicating it is designed to execute arbitrary code. This is a common technique for downloading and executing further malicious payloads.

Heuristics 8

VBA macros detected medium 6 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 155890 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	155890 bytes
SHA-256: `fe65836af43a5a8225e4c40afca95ec03d09885ad689365a8e20770f37ebdd2a`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub Document_Open() On Error Resume Next 'some doghouses dystocias sphincteric ghrush loxodontous Transit amphanthia double-bitt vesicated verruculose sarcocol bunglings crow-quill Volkswagen unabsorbed discession demeanour perbromide buhlworks spleniti brotherred blowspray Blackfoot nonnomadic melinite hokerer gonid progenitress red-haired commuter ironsmith tyrosyl perceptual cardo benchman outskipped fourer Paleozoic world-enlarging sitten 'preshare unsyllabled Astilbe wind-shift overpatient solenoid Brahmanhood Muscogee Baldwinville double-leaded unharmonize Pyrosomidae elboic triple-piled rugate analyzable skrimshander largish expergefacient semisaltire underaim convicts undercap Sung prim-mannered submerge firepot protuberances directorially jayvee unpresidential Chayota monandrian saulie 'asynchronous divinified xanthenes scimitars azobenzene gambling much-engrossed allocaffeine Hale linley anticks Aghorapanthi blunt-lobed king-maker tensibly twaddled skeery COSMOS Fallsburg zebrinnies hootchy-kootchy warmups omittance orchidacean internationalised underachieve agreeable meritorious ligula two-blocks overcharging prelates 'cardamoms mystagog Prylis hygeist couthier cytol tuberculization komma-ichi-da autoist unfleeting amentula Iosep pompist ametabolism Lingle peekaboos sea-deep puggrees verticillated swick Chernomorish destructionist recharters sportful bannerless above-found learn Craryville endosymbiosis halenesses senates condemners lalled noncommonable choyroot neurofibrilla supervenosity vegetables stereologically nonsingleness unobjectionably sleeves 'undersitter premeditating Favilla husbandly diothelism unsoluble Ovid Un-protestantlike colophony compilations pot-pourri mestizo finjan scotopia slent daekon egg-nog urbanists Putscher Reinhold nototribe inken Estotiland Walsall NETBIOS unhalting Heiltsuk unseemliest coappriser all-considering self-intersecting merchant-tailor cockabondy sammier prodromatic preexplain tetranitroaniline Mercatorial 'twice-promised prevetoes pria backcomb chrysanisic gargarism infauna dichotomic muscle-kneading splint-bottom expiries accinging ponier Galili totuava serrirostrate slandered moor-fowl townscape dendrometer grammaticaster fragmentist skokiaan seemlily superinfeudation Stuart tribunate Palamite needed chesterfields mycotoxic islandic MFT inaccuracy Piaroa Skagerrak aplomb Aramus saltant haffet 'crinkleroot staphyle glauber teemers fruitlike hypopharynges grangers murrnong nonarrival oxygens chooseable curlycues AOS bird-foots speedboater discohexaster ripsack ribibe skip-bombing Gwinn caprylate androgynary Clewiston iridize parged mogographia scalpeen nonconterminal atle ataxophemia rejoice knap costo- 'catabolizing galvanotonic inurned delimitizing shortcoming retrouss ina pseudohistorical Soudanese drifter macrolinguistically oversetting saucerlike forgivingness clodlike ZGS liaises intrail thumbbird dilettanteism ironwares souls Kokand beamful OHG matterful gundi outriggerless biostrome pollinctor ascula spermatophoral salvageability whistles cosponsors mumpers hook-up Lillie lacuna ligures latticing renderset 'staumeral huge-limbed unacerbic lysozyme sandalled abutment dude identifiably Ulrika steatopygia akhara detect diuturnal kalendar lanosity grandstands hysterotome agister nonappendance fumarate diagrammers re-strain polyglottist mohoohoo dibbles Dimmitt destinism interpled emphasizes ungratefully Germanism brucellas clops 'ceraunomancy mimish Line tinny trussings up-to-date unlawlearned Jammal chalon jug-bitten mirkiest clou intromit Coniferae spalled prooflessly Sinicized Therron instantial jejuna aviators scrab noncorroboration top-hole unbit welts oligosiderite pouser Dygal lyophilize infrareds versiform domicilement Squill Constance pilage muffed elephantic 'al ... (truncated)

SHA-256: fe65836af43a5a8225e4c40afca95ec03d09885ad689365a8e20770f37ebdd2a

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()
On Error Resume Next
'some doghouses dystocias sphincteric ghrush loxodontous Transit amphanthia double-bitt vesicated verruculose sarcocol bunglings crow-quill Volkswagen unabsorbed discession demeanour perbromide buhlworks spleniti brotherred blowspray Blackfoot nonnomadic melinite hokerer gonid progenitress red-haired commuter ironsmith tyrosyl perceptual cardo benchman outskipped fourer Paleozoic world-enlarging sitten
'preshare unsyllabled Astilbe wind-shift overpatient solenoid Brahmanhood Muscogee Baldwinville double-leaded unharmonize Pyrosomidae elboic triple-piled rugate analyzable skrimshander largish expergefacient semisaltire underaim convicts undercap Sung prim-mannered submerge firepot protuberances directorially jayvee unpresidential Chayota monandrian saulie
'asynchronous divinified xanthenes scimitars azobenzene gambling much-engrossed allocaffeine Hale linley anticks Aghorapanthi blunt-lobed king-maker tensibly twaddled skeery COSMOS Fallsburg zebrinnies hootchy-kootchy warmups omittance orchidacean internationalised underachieve agreeable meritorious ligula two-blocks overcharging prelates
'cardamoms mystagog Prylis hygeist couthier cytol tuberculization komma-ichi-da autoist unfleeting amentula Iosep pompist ametabolism Lingle peekaboos sea-deep puggrees verticillated swick Chernomorish destructionist recharters sportful bannerless above-found learn Craryville endosymbiosis halenesses senates condemners lalled noncommonable choyroot neurofibrilla supervenosity vegetables stereologically nonsingleness unobjectionably sleeves
'undersitter premeditating Favilla husbandly diothelism unsoluble Ovid Un-protestantlike colophony compilations pot-pourri mestizo finjan scotopia slent daekon egg-nog urbanists Putscher Reinhold nototribe inken Estotiland Walsall NETBIOS unhalting Heiltsuk unseemliest coappriser all-considering self-intersecting merchant-tailor cockabondy sammier prodromatic preexplain tetranitroaniline Mercatorial
'twice-promised prevetoes pria backcomb chrysanisic gargarism infauna dichotomic muscle-kneading splint-bottom expiries accinging ponier Galili totuava serrirostrate slandered moor-fowl townscape dendrometer grammaticaster fragmentist skokiaan seemlily superinfeudation Stuart tribunate Palamite needed chesterfields mycotoxic islandic MFT inaccuracy Piaroa Skagerrak aplomb Aramus saltant haffet
'crinkleroot staphyle glauber teemers fruitlike hypopharynges grangers murrnong nonarrival oxygens chooseable curlycues AOS bird-foots speedboater discohexaster ripsack ribibe skip-bombing Gwinn caprylate androgynary Clewiston iridize parged mogographia scalpeen nonconterminal atle ataxophemia rejoice knap costo-
'catabolizing galvanotonic inurned delimitizing shortcoming retrouss ina pseudohistorical Soudanese drifter macrolinguistically oversetting saucerlike forgivingness clodlike ZGS liaises intrail thumbbird dilettanteism ironwares souls Kokand beamful OHG matterful gundi outriggerless biostrome pollinctor ascula spermatophoral salvageability whistles cosponsors mumpers hook-up Lillie lacuna ligures latticing renderset
'staumeral huge-limbed unacerbic lysozyme sandalled abutment dude identifiably Ulrika steatopygia akhara detect diuturnal kalendar lanosity grandstands hysterotome agister nonappendance fumarate diagrammers re-strain polyglottist mohoohoo dibbles Dimmitt destinism interpled emphasizes ungratefully Germanism brucellas clops
'ceraunomancy mimish Line tinny trussings up-to-date unlawlearned Jammal chalon jug-bitten mirkiest clou intromit Coniferae spalled prooflessly Sinicized Therron instantial jejuna aviators scrab noncorroboration top-hole unbit welts oligosiderite pouser Dygal lyophilize infrareds versiform domicilement Squill Constance pilage muffed elephantic
'al
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.