Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 55e7cdbd22930d8f…

MALICIOUS

Office (OLE) / .DOC

322.0 KB Created: 2021-09-16 09:42:00
MD5: f497f4739f95f184acf4094a3e0c4079 SHA-1: 62ea5faa5c483dc70b6b22dfc87677321e7d6c5f SHA-256: 55e7cdbd22930d8fce9e9daf7b221c399164bf5e79ad22eda62f931141811eb1
104 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains a VBA macro that triggers on document open. This macro attempts to create a new document named 'reform.doc' in the user's template path. The script also includes logic to potentially copy content and save it to this new file, suggesting an attempt to establish persistence or deliver a secondary payload. The exact content and functionality of the saved file are unclear due to script truncation.

Heuristics 5

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/2006/encryption
    • http://schemas.microsoft.com/office/2006/keyEncryptor/password
    • http://schemas.microsoft.com/office/2006/keyEncryptor/certificate
    • http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
c5eb4757ddca02546c29b8bb7ebe1e28259400c86649771c5092c092ea3df037		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2971 bytes
ole10native_00.bin
1301ad2f56cb05e2e1d6e9246ec99a39f774b5cfe88be5d724e731284ad0b934		 ole-package OLE Ole10Native stream: ObjectPool/_1693260807/Ole10Native 156481 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.95, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.