Malicious Office (OLE) / .DOCX — malware analysis report

Static analysis result for SHA-256 457c0227a9372153…

MALICIOUS

Office (OLE) / .DOCX

366.5 KB Created: 2024-07-19 10:29:00 Authoring application: Microsoft Office Word
MD5: 33dfd6120e9dd0ed60e7561b7f5ab309 SHA-1: 87be8ba42e32dc58e4993e86c44139360754cd64 SHA-256: 457c0227a937215335b9c7793c83f3c9b5329ea839d8b2b44e20dda0e808379c
648 Risk Score

Malware Insights

MITRE ATT&CK
T1059.003 Windows Command Shell T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer T1071.001 Web Protocols

The sample contains VBA macros with a Document_Open auto-execution routine that utilizes WScript.Shell to invoke cmd.exe and PowerShell. The document body explicitly instructs the user to copy and paste commands into these execution contexts, a common lure for executing downloaded payloads. The presence of certutil.exe references further suggests a download and decode capability.

Heuristics 17

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Reference to certutil (download/decode) high SC_STR_CERTUTIL
    Reference to certutil (download/decode)
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://172.104.160.126:8099
    • https://go.microsoft.com/fwlink/?linkid=2280386
    • https://support.microsoft.com/help/4026181/windows-10-find-my-bitlocker-recovery-key
    • https://www.crowdstrike.com/blog/statement-on-falcon-content-update-for-windows-hosts/
    • https://go.microsoft.com/fwlink/?linkid=2281008
    • https://aka.ms/vs/17/release/vc_redist.x64.exe
    • https://learn.microsoft.com/troubleshoot/mem/configmgr/os-deployment/understand-pxe-boot
    • https://learn.microsoft.com/troubleshoot/mem/configmgr/os-deployment/advanced-troubleshooting-pxe-boot
    • https://techcommunity.microsoft.com/t5/configuration-manager-blog/you-want-to-pxe-boot-don-t-use-dhcp-options/ba-p/275562
    • https://www.intel.com/content/www/us/en/support/articles/000054990/intel-nuc/intel-nuc-kits.html
    • https://aka.ms/WRH
    • https://support.microsoft.com/topic/kb5042421-crowdstrike-issue-impacting-windows-endpoints-causing-an-0x50-or-0x7e-error-message-on-a-blue-screen-b1c700e0-7317-4e95-aeee-5d67dd35b92f
    • https://support.microsoft.com/topic/0d7741f7-aca1-4487-8a54-bd431cb49455
    • https://support.microsoft.com/topic/d3928eaa-160c-4b19-ae64-930e2fa68194
    • https://learn.microsoft.com/windows-365/enterprise/restore-overview
    • https://learn.microsoft.com/windows-365/business/restore-overview
    • https://azure.status.microsoft/status
    • http://schemas.openxmlformats.org/drawingml/2006/main
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliography
    • http://schemas.openxmlformats.org/officeDocument/2006/customXml

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
0bc1d9a6d940d42e01b80758f8a1966dd3449398eae21cf264e3e377b3007a72		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 90451 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 shell/COM execution token(s). Carved artifact contains 986 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.