Malicious Office (OLE) — malware analysis report

Heuristics 10

• ClamAV: Doc.Malware.Generic-6786425-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Malware.Generic-6786425-0
• VBA macros detected medium 3 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

        hwTLIiIqiYITpK = 62886103 - iDTlkdZEXbzIAQcIpPoJ
  ZdBQpzrNP = Array(aYdpNYPMJ, WlJqioLs, juuVhFrm, Interaction.Shell(SVzaIbNij, pWKWfDicSn), znvwV)
     wBwRpCQWDLuIZwPDwXP = aLWWviUWXiRzKiPUp * Rnd(40588582 / Sin(CilmEidclucQuIKwmia)) / Wfd + Int(149446869 - Rnd(75184937 - Tan(223246823) * 297730798 - Cos(UtwwqivNqwNmpZSoSBjcvRXo)) / 339592542 * Sin(239638211 / Tan(188168705) / 271865084 / Hex(98639342))) + 233484068 + CStr(100966981) - 132280219 / CLng(244165630) * 251850378 - Fix(116231236 - Hex(71574958) * 245887200 / ChrW(lCzOawvXJNMmEJwQDCWH / 336734715))

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Attribute VB_Control = "TextBox1, 0, 0, MSForms, TextBox"
  Sub autoopen()
  LMcatA

• Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
  Suspicious cmd.exe invocation with execution flag
• Reference to PowerShell high SC_STR_POWERSHELL
  Reference to PowerShell
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/officeDocument/2006/bibliography In document text (OLE body)

  • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.