Malicious Office (OLE) — malware analysis report

Heuristics 9

• ClamAV: Doc.Malware.Powload-6794695-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Malware.Powload-6794695-0
• VBA macros detected medium 3 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• VBA instantiates a dangerous COM class by CLSID critical OLE_VBA_GETOBJECT_CLSID_DANGEROUS
  VBA uses GetObject("new:{CLSID}") to instantiate an execution/scripting-capable COM class by its raw CLSID, avoiding the CreateObject ProgID that name-based detection keys on.
  Matched line in script

  End Select
  Set ZZKijTUEO = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8" + JatIQwX)
     On Error Resume Next

• GetObject call high OLE_VBA_GETOBJ
  GetObject call
  Matched line in script

  End Select
  Set ZZKijTUEO = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8" + JatIQwX)
     On Error Resume Next

• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Attribute VB_Customizable = True
  Sub AutoOpen()
     On Error Resume Next

• Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
  Suspicious cmd.exe invocation with execution flag
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.