Office (OLE) malware analysis — malicious · f890973b757f0af7

MALICIOUS

Office (OLE)

103.5 KB Created: 2020-03-03 17:12:00 Authoring application: Microsoft Office Word First seen: 2020-05-25

MD5: f1434ad7a0414a1e88fb8ca29693c073 SHA-1: 3de628f3b9c6f12374fd89d7145c253ccc665e55 SHA-256: f890973b757f0af7e69c2c8236e9832407620bad65267ecb51e76a050c3e0bef

304 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros, including a Document_Open auto-execution macro, which is a common technique for initial execution. The macro utilizes `GetObject` and `CreateObject` to launch a process via WMI (`Win32_Process`), indicating an attempt to execute arbitrary code. This is strongly suggestive of a downloader or dropper functionality, aiming to fetch and run a secondary payload. The specific WMI call `winmgmts:\\.\root\cimv2:Win32_Process` is a key indicator of this execution method.

Heuristics 9

ClamAV: Doc.Malware.Generickdz-7608151-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Generickdz-7608151-0
VBA macros detected medium 5 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE

VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6338 bytes
SHA-256: `66348b37c8556106acc04f1516dabecfbca0fc0dbd9cd6247f0d5f10b8babf3f`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 long base64-like blob(s).
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub ExportVCFForEMUI() '''???EMUI??vcf?? '''???? Dim FSO Dim ADSM, ADSM2 Dim FilePath, FileName Dim TheTable, CtrlLogo As String Dim LastContactCell As Range Dim RelationType Set FSO = CreateObject("scripting.filesystemobject") Set ADSM = CreateObject("ADODB.Stream") Set ADSM2 = CreateObject("ADODB.Stream") FilePath = Range("????!C2") FileName = Year(Now()) & Month(Now()) & Day(Now()) & Hour(Now()) & Minute(Now()) & Second(Now()) TheTable = "??????" ADSM.Type = 2 ADSM.Charset = "UTF-8" ADSM.Open Dim i, j For i = 1 To Sheets.Item(TheTable).UsedRange.Rows.Count '??sheet??,?????????row??????? CtrlLogo = Sheets.Item(TheTable).Cells(i, 2) Select Case CtrlLogo Case Range("????!C1") ADSM.writetext "BEGIN:VCARD", 1 ADSM.writetext "VERSION:3.0", 1 If Range(TheTable & "!" & "C" & i) <> "" Or Range(TheTable & "!" & "D" & i) <> "" Then ' ?????????? ADSM.writetext "FN:" & Range(TheTable & "!" & "C" & i) & Range(TheTable & "!" & "D" & i), 1 '??FN???????? ADSM.writetext "N:" & Range(TheTable & "!" & "C" & i) & ";" & Range(TheTable & "!" & "D" & i), 1 '????N?? If Range(TheTable & "!" & "J" & i) <> "" Then ADSM.writetext "TEL;TYPE=CELL:" & Range(TheTable & "!" & "J" & i), 1 '?????? If Range(TheTable & "!" & "M" & i) <> "" Then ADSM.writetext "TEL;TYPE=WORK:" & Range(TheTable & "!" & "M" & i), 1 '??????,???????? If Range(TheTable & "!" & "L" & i) <> "" Then ADSM.writetext "TEL;TYPE=HOME:" & Range(TheTable & "!" & "L" & i), 1 '?????? If Range(TheTable & "!" & "O" & i) <> "" Then ADSM.writetext "EMAIL;TYPE=WORK:" & Range(TheTable & "!" & "O" & i), 1 '?????? If Range(TheTable & "!" & "N" & i) <> "" Then ADSM.writetext "EMAIL;TYPE=HOME:" & Range(TheTable & "!" & "N" & i), 1 '?????? If Range(TheTable & "!" & "G" & i) <> "" Then ADSM.writetext "ORG:" & Range(TheTable & "!" & "G" & i) & Range(TheTable & "!" & "H" & i), 1 '????,??????? If Range(TheTable & "!" & "I" & i) <> "" Then ADSM.writetext "TITLE:" & Range(TheTable & "!" & "I" & i), 1 '????,?????I If Range(TheTable & "!" & "P" & i) <> "" Then ADSM.writetext "ADR;TYPE=HOME:;;" & Range(TheTable & "!" & "P" & i) & ";;;;", 1 '???????,?P? If Range(TheTable & "!" & "Q" & i) <> "" Then ADSM.writetext "ADR;TYPE=WORK:;;" & Range(TheTable & "!" & "Q" & i) & ";;;;", 1 '???????,?Q? If Range(TheTable & "!" & "R" & i) <> "" Then ADSM.writetext "BDAY:" & Format(Range(TheTable & "!" & "R" & i), "yyyy-m-d"), 1 '????,?R? If Range(TheTable & "!" & "S" & i) <> "" Then ADSM.writetext "URL:" & Range(TheTable & "!" & "S" & i), 1 '????,??S?,????Mailto:??? If Range(TheTable & "!" & "K" & i) <> "" Then ADSM.writetext "X-QQ:" & Range(TheTable & "!" & "K" & i), 1 '??QQ,???????QQ?? If Range(TheTable & "!" & "T" & i) <> "" Then ADSM.writetext "X-ANDROID-CUSTOM:vnd.android.cursor.item/contact_event;" & Range("????!" & "T" & i) & ";1;(1????????????);;;;;;;;;;;;", 1 '???????,??????T? If Range(TheTable & "!" & "U" & i) <> "" Then ADSM.writetext "X-ANDROID-CUSTOM:vnd.android.cursor.item/contact_event;" & Range("????!" & "U" & i) & ";3;(1????????????);;;;;;;;;;;;", 1 '???????,??????U? If Range(TheTable & "!" & "V" & i) <> "" Then ADSM.writetext "X-ANDROID-CUSTOM:vnd.android.cursor.item/contact_event;" & Range("????!" & "V" & i) & ";0;(1????????????);;;;;;;;;;;;", 1 '???????,??????V? For j = 1 To Sheets.Item("???").UsedRange.Rows.Count Select Case Range("???!C" & j).Value Case "??", "??" RelationType = 1 Case "??" RelationType = 2 Case "??", "??", "??" RelationType = 3 Case "??", "??", "??" RelationType = 4 Case "??", "??" RelationType = 5 Case "??", "??" RelationType = 6 Case "??", "??", "??" RelationType = 7 Case "??", "??" RelationType = 8 Case "??" RelationType = 9 Case "????", "???", "??" RelationType = 10 Case "???" RelationType = 11 Case "??" RelationT ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.