Office (OLE) / .DOC malware analysis — malicious · 331d2a27f8a0e5f3

MALICIOUS

Office (OLE) / .DOC

9.0 KB First seen: 2022-11-23

MD5: 84ad4ffb36dcabfd32d9b8281c2e3723 SHA-1: 678c2968f362a0704d1dd7a326674cfb98e2c3d7 SHA-256: 331d2a27f8a0e5f367f2f9b5094859552998162b1a8647d64cf4ca3c04b9f652

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1218.011 Signed Binary Proxy Execution: Rundll32 T1027 Obfuscated Files or Information T1105 Ingress Tool Transfer

The sample contains heavily obfuscated VBA macros designed to execute shellcode. Critical heuristics indicate an auto-exec loader that reads configuration from document properties, decodes it, and then uses memory manipulation APIs like VirtualProtect to execute the payload. This strongly suggests a downloader or initial access mechanism for a more complex attack.

Heuristics 6

VBA property-stored shellcode loader critical OLE_VBA_PROPERTY_SHELLCODE_LOADER

VBA auto-exec macro takes the address (VarPtr) of a byte buffer decoded from a document property, marks memory executable (VirtualProtect/VirtualAlloc), and transfers control through a callback API (e.g. SetTimer/EnumWindows). The payload is hidden in the document properties rather than the macro source — the SVCReady loader pattern, a native shellcode runner rather than a parser CVE.
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA reads reversed config from document properties high OLE_VBA_REVERSED_DOCPROP_CONFIG

VBA applies StrReverse to values read from the document's custom/built-in properties. Storing reversed configuration (URLs, CLSIDs, env-var names, payload names) in document properties keeps indicators out of the macro source — an obfuscation technique used by the SVCReady loader.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `867f5bdef4f994f2c837fab53426d0274cc1ca0f711bdf186e5b7a0c72019c07`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	5335 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.