Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 33def5bb43bced59…

MALICIOUS

Office (OLE) / .DOC

630.5 KB Created: 2021-12-23 08:04:00 Authoring application: Microsoft Office Word
MD5: 491bef19228f72373e9ffa4d9b9b9ab5 SHA-1: 501913fd6eef9d571b65ecbe735374a28fbd5bb6 SHA-256: 33def5bb43bced5911ef224484b5eb2862fdc08bf11f16874abf8862f5ca2c78
142 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a VBA macro that is automatically executed upon opening the document. This macro writes a PowerShell command to a file named 'C:\Users\Public\dssdd.cmzd' and then executes it. The PowerShell command itself downloads a second-stage executable from 'http://3.65.182.182/ff/60021300116080.exe' and saves it as 'C:\Users\Public\Documents\wondereasy.exe'. This indicates a downloader or droppper functionality.

Heuristics 5

  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
3a41b93d7fe1c298999ef64b9b27932f92d6de971901bc68ef907d2c8f4121c4		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1575 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.