Office (OLE) / .DOC malware analysis — malicious · 51fc6b1e68ce543b

MALICIOUS

Office (OLE) / .DOC

96.5 KB Created: 2020-03-19 21:34:27 Authoring application: Microsoft Excel

MD5: 5984bd4002baaf1f4461424c603815bd SHA-1: 46de0f3d1fa7cac9881e22faf88f92eb268629b5 SHA-256: 51fc6b1e68ce543b8ce12732b74a392bca52c935a28f5be06df021ff26673bf0

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 Malicious File T1059.001 PowerShell T1105 Ingress Tool Transfer

The sample contains Excel 4.0 (XLM) macros, indicated by the OLE_XLM_AUTOOPEN and OLE_XLM_DANGEROUS_FN heuristics. The macros reference the URLDownloadToFile API, suggesting an intent to download a second-stage payload from the provided URLs. The presence of ShellExecute API calls further supports the execution of downloaded content. The document body contains 'DllRegisterServer', which could be part of the payload execution chain.

Heuristics 6

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
XLM Auto_Open with dangerous formula APIs high OLE_XLM_DANGEROUS_FN

Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://aperforrmingnextyou.xyz/372873/svu.dll~
- https://aperforrmingnextyou.xyz/372873/svu.dll
- https://aperforrmingnextyou.x~

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `6cd894a56b3fecaff9e5260cf3d7427aa7e37628410c8ea078aacce1bf2c1fcd`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	29754 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s).

Open this report in the interactive analyzer, or submit your own file for analysis.