Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5f70ad5a48f1b4b4…

MALICIOUS

Office (OLE)

835.0 KB Created: 2019-08-30 09:14:50 Authoring application: Microsoft Excel
MD5: f33b344e2c7925453838e850c1f07e20 SHA-1: 6628e359af0c825b494263c3a1fc9a944f2d9410 SHA-256: 5f70ad5a48f1b4b451fb838f3d242c9f7dc099a94727ab0f5a3e32fa142a26b1
402 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The file contains VBA macros that leverage Windows Script Host and API calls like VirtualAlloc and LoadLibrary, indicating a dropper functionality. It also embeds a PE executable, strongly suggesting it's designed to download and run a secondary payload. The presence of a Shell() call in the VBA further supports the execution of external code.

Heuristics 10

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Embedded PE executable critical OLE_EMBEDDED_EXE
    MZ/PE header found inside document — possible embedded executable
  • ClamAV: Win.Dropper.Hideproc-6663113-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Dropper.Hideproc-6663113-0
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.microsoft.com0
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
888c70d21f83f913161586d9572083be4266d3106ae0f87526fc31f336071aa6		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 14358 bytes
embedded_office_000044f1.exe
5084583a6b248c5fe9cc79bd290cf96b865076b2ec47ff378dbc2dc0026fd993		 embedded-pe Office MZ+PE at offset 0x44F1 837391 bytes
Detection
ClamAV: Win.Dropper.Hideproc-6663113-0
Obfuscation or payload: unlikely
ole10native_00.bin
9dc5a0bfb900a50933edcd585ffcbc4bed2af044e653c6df90ad0229c5fd64db		 ole-package OLE Ole10Native stream: MBD00059305/Ole10Native 618013 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.