Office (OLE) / .DOC malware analysis — malicious · 5f882d0fadb703af

MALICIOUS

Office (OLE) / .DOC

151.5 KB Created: 2020-04-27 12:52:00 Authoring application: Microsoft Office Word

MD5: 292f8e3afb942e93e97274b67bbd16da SHA-1: 626d27d9af3eb68169aa441b4c96f415ac86a27a SHA-256: 5f882d0fadb703af8bd850cc02481975e752129ad5581501fadc65b9cb25d678

162 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The file is a malicious OLE document containing VBA macros. The presence of ShellExecute and GetObject API calls, along with the ClamAV detection, strongly indicates malicious intent. The VBA macros are likely responsible for downloading and executing a second-stage payload, a common technique for malware distribution.

Heuristics 5

ClamAV: Doc.Malware.Mrcl-7723011-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Mrcl-7723011-0
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `15b93d8deff9a778e9f5f6b9611d134c827d8fd21984803f49d9b3184481c1c9`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	38589 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.