Office (OLE) / .DOC malware analysis — malicious · 27c35f54517bbd4e

MALICIOUS

Office (OLE) / .DOC

21.5 KB Created: 2021-05-09 14:04:00 Authoring application: Microsoft Office Word

MD5: 037e717de225d305363e9b27f3165334 SHA-1: d5ff19d88e25888394345d32c9da6f86e3a7783b SHA-256: 27c35f54517bbd4e9ce9ce6760bef19ca49a3d1bb31397bfe50a5ce996ae9757

82 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 Command and Scripting Interpreter T1071.001 Application Layer Compromise T1566.001 Phishing T1071.002 Remote Services - Scheduled Task

The heuristic firings, specifically `SC_STR_BITSADMIN` and `SE_LOLBIN_RUN_COMMAND`, strongly indicate the document is designed to execute a command-line utility, `bitsadmin`, to download a file. The embedded URL points to an image, likely a placeholder or a visual element within the malicious document. The document leverages a macro to trigger this download. The overall intent is to establish a foothold on the system and potentially execute further malicious code. The use of `bitsadmin` is a common tactic for stealthy file downloads.

Heuristics 3

Reference to bitsadmin (download) high SC_STR_BITSADMIN

Reference to bitsadmin (download)
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://rinaldomattei.firstcloudit.com/Carta_identita.jpg
- http://schemas.openxmlformats.org/drawingml/2006/main

Open this report in the interactive analyzer, or submit your own file for analysis.