Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 3c937e7ce5a32107…

MALICIOUS

Office (OLE) / .DOC

4.05 MB Created: 2010-07-30 01:33:00 Authoring application: Microsoft Office Word
MD5: a97efb1eee0c3ab492250da8389bfbe0 SHA-1: d74387f68a257474b3bf3d9e326711200868dda3 SHA-256: 3c937e7ce5a321077390b8c593d2db94a6c810e22120391c88ff906182ee4044
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.005 Visual Basic

The document contains VBA macros, including an AutoOpen macro, and instructs the user to enable macros to install "eMarking Assistant". This is a common social engineering tactic to bypass macro security. The macros likely download and execute additional payloads, as indicated by the "Suspicious extracted artifact" heuristic firing. Several unknown URLs related to "emarkingassistant.com" were extracted and are likely part of the attack infrastructure.

Heuristics 6

  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CallByName call high OLE_VBA_CALLBYNAME
    CallByName call
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://emarkingassistant.com/usingindex.htm
    • http://eMarkingAssistant.com
    • http://emarkingassistant.com/erubricmovie.html
    • http://eMarkingAssistant.com/usingindex.htm
    • http://emarkingassistant.com/installingindex.htm
    • http://emarkingassistant.com/community/mod/glossary/view.php?id=5
    • http://eMarkingAssistant.com/erubric.htm
    • http://www.cshe.unimelb.edu.au/assessinglearning/03/plagMain.html
    • http://www.newcastle.edu.au/service/teaching-learning/projects/rubrictemplates/context.html
    • http://www.ntwind.com/software/winsnap/download-free-version.html
    • http://emarkingassistant.com
    • http://knowledgegarden.usq.edu.au/tiki-index.php?page_id=72
    • http://emarkingassistant.com/erubric.htm
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page_id=72
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page_id=944
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page_id=90
    • http://www.usq.edu.au/ltsu/
    • http://www.usq.edu.au/plagiarism/infostud/
    • http://unilearning.uow.edu.au/
    • http://unilearning.uow.edu.au/academic/2di.html
    • http://unilearning.uow.edu.au/academic/2d.html
    • http://unilearning.uow.edu.au/academic/4a.html
    • http://unilearning.uow.edu.au/academic/2b.html
    • http://unilearning.uow.edu.au/academic/2c.html
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page=intext+citations+and+reference+list
    • http://www.usq.edu.au/library/help/ehelp/ref_guides/apastyle/
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page_id=323
    • http://www.usq.edu.au/library/help/ehelp/ref_guides/apastyle/chapters.htm
    • http://www.some.com
    • http://www.usq.edu.au/library/help/ehelp/ref_guides/apastyle/electronic.htm
    • http://knowledgegarden.usq.edu.au/tiki-index.php?page_id=973
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page=Hints+for+using+Microsoft+Word
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page_id=497
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page_id=973
    • http://www.usq.edu.au/learningcentre/alsonline/acwrite/parstruct
    • http://unilearning.uow.edu.au/effective/4.html
    • http://www.baker-evans.com/knowledgegarden/tiki-index.php?page=presenting+and+submitting+assignments
    • http://unilearning.uow.edu.au/writing/3c.html
    • http://unilearning.uow.edu.au/writing/3ai.html
    • http://unilearning.uow.edu.au/writing/2a.html
    • http://unilearning.uow.edu.au/writing/2b.html
    • http://unilearning.uow.edu.au/writing/remind.html
    • http://unilearning.uow.edu.au/writing/2c.html
    • http://unilearning.uow.edu.au/essay/4aiva.html
    • http://unilearning.uow.edu.au/essay/4aivb.html
    • http://unilearning.uow.edu.au/essay/4aivc.html
    • http://unilearning.uow.edu.au/effective/3a.html
    • http://unilearning.uow.edu.au/effective/2.html
    • http://www.usq.edu.au/learningcentre/
    • http://emarkingassistant.com/
    +51 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
2a7eaa317e3a7cca55f1251f49ddf01d905f045eee880c8a27a281d8079a0131		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 370098 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 41 Chr/ChrW string-construction calls.
ole10native_00.bin
6290235811d71e1ce90192567c9c07e95ad03243b2526181b508a1dff37df2ba		 ole-package OLE Ole10Native stream: ObjectPool/_1329481298/Ole10Native 15206 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.80, consistent with packed or encrypted content.
ole10native_02.bin
e828249c4bd6815034a6a33f0217f46df26b673d403038c043405c5a0a81c02b		 ole-package OLE Ole10Native stream: ObjectPool/_1330976990/Ole10Native 33266 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.83, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.