Office (OLE) / .DOC malware analysis — malicious · 0ae635cc732e295d

MALICIOUS

Office (OLE) / .DOC

43.5 KB Created: 2016-11-16 21:01:00 Authoring application: Microsoft Office Word

MD5: 0d994b1e685b8710f06c6e9c439caad6 SHA-1: 578391a309db4fc203ddc4e1ce82715a7def9a79 SHA-256: 0ae635cc732e295d0de3cbf49c73b083d50c0f244189980744ffe558aa88e30b

368 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1071.001 Web Protocols

The sample is a malicious Office document containing VBA macros. The AutoOpen macro attempts to check for an existing file and, if not present, proceeds to read the document's content. The presence of Shell() and WScript.Shell calls indicates an intent to execute external commands or scripts, likely to download and execute a secondary payload. The document body itself is a lure, presenting a fake security warning to encourage macro execution.

Heuristics 9

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
ClamAV: Doc.Dropper.Agent-1849961 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-1849961
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6dc972bb7a38800df5c1c27fcdf1004235940458c013449faf0b524acc188667`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.