Office (OLE) / .DOC malware analysis — malicious · 5189b2a9e69b48ef

MALICIOUS

Office (OLE) / .DOC

69.5 KB Created: 2022-03-28 09:43:00 Authoring application: Microsoft Office Word First seen: 2022-03-30

MD5: e5f86454862a7288a5fceb215872cd6f SHA-1: c9586e701a4bb90423f0e4ccf09290b2642c1d39 SHA-256: 5189b2a9e69b48ef464f8f59ab722717ab162eb33ab7f493791f13e28d59473e

202 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample is a malicious Word document containing a VBA macro triggered by the Document_Open event. This macro uses CreateObject to instantiate the Windows Installer service and then calls InstallProduct with a URL pointing to an MSI file. This indicates the document's purpose is to download and execute a second-stage payload from the specified URL. The embedded URL "https://filebin.net/chd313qsab7e4ta9/new.msi" is the primary IOC for the secondary payload.

Heuristics 7

Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED

Long run of 0x41 bytes
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://filebin.net/chd313qsab7e4ta9/new.msi�
- https://filebin.net/chd313qsab7e4ta9/new.msi
- https://docs.microsoft.com/en-us/windows/win32/msi/action
- http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `73f2ab1069ca5b75a905ff3bc169ef9d3e8edbb279aad83941a0dda870c78a4d`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	639 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.
`ole10native_00.bin` `21a5ba8afcfa78313eb1cda9bbc9dc76c4cb8b2ce843a4962140084a58e72849`	ole-package	OLE Ole10Native stream: ObjectPool/_1710045727/Ole10Native	4516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.