Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 02f355e20922fb9f…

MALICIOUS

Office (OLE) / .DOC

37.5 KB Created: 2021-07-06 04:33:00 Authoring application: Microsoft Office Word
MD5: a9f73033838535c1f9fd9534f94054d5 SHA-1: a9d2fa6d4680e36699f7ec7b3bf94cde20a134d2 SHA-256: 02f355e20922fb9f325569f7bb3466587823b799ae4a43bf715ee92864d0bd74
162 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros that utilize `CreateObject` and `CallByName` functions, indicative of malicious activity. The macros attempt to send data to the URL `https://bigben-soft-down.com/ecm/ibm/1628606299/feedback` and process a response, likely to download and execute a second-stage payload. The ClamAV detection name 'Doc.Downloader.Valyria-10033997-0' further supports its downloader functionality.

Heuristics 5

  • ClamAV: Doc.Downloader.Valyria-10033997-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-10033997-0
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bigben-soft-down.com/ecm/ibm/1628606299/feedback
    • http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
18e58ca9644ad789397b9183a606ed6c65314d90f1948337aade13175b902f8a		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.