Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 570e47e76f1ea845…

MALICIOUS

Office (OLE)

53.0 KB Created: 2018-11-05 17:18:00 Authoring application: Microsoft Office Word First seen: 2019-03-10
MD5: ffde75b844e512882a9edacde475dad8 SHA-1: 46424a9d7c05794cfb877953df4b59a9d79bcdde SHA-256: 570e47e76f1ea845054abb8772541455aaf4b8bf62eb69cbef1ce3190b224516
130 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1059.003 Windows Command Shell T1566.001 Spearphishing Attachment

The sample contains a heavily obfuscated PowerShell command embedded within the document body. This command appears to decompress and execute a Base64 encoded payload, likely a second-stage downloader. The presence of heuristics for cmd.exe and PowerShell invocation, along with the embedded command, strongly suggests an attempt to download and execute further malicious content. The document itself is likely delivered as a spearphishing attachment.

Heuristics 5

  • Suspicious cmd.exe invocation with execution flag high SC_STR_CMD
    Suspicious cmd.exe invocation with execution flag
  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 325 bytes
SHA-256: dfc6d2b67bc21dca2c5069393463b7f6a67b8aff04109be290583ad8aef57569
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "GAhESna"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Macro code was removed by Symantec Disarm

Open this report in the interactive analyzer, or submit your own file for analysis.