Office (OLE) / .DOC malware analysis — malicious · 618cfb0b74aa99ab

MALICIOUS

Office (OLE) / .DOC

14.5 KB First seen: 2022-08-12

MD5: 84ceadbe4deb4f7801732e22c964475e SHA-1: 7ce8a2cfe362029b6464af515303eb0977780777 SHA-256: 618cfb0b74aa99aba1ff6ba05b76dda3f577edb2a55cd90e572c1ce0344c95eb

240 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information

The critical heuristic 'OLE_VBA_PROPERTY_SHELLCODE_LOADER' indicates that the VBA macros are designed to execute shellcode loaded from document properties. The 'Document_Open' macro is triggered upon opening the document, and it reads configuration data from document properties using a reversed string function. This shellcode is likely used to download and execute a secondary payload from a remote source, as suggested by the obfuscated script attempting to read values from custom document properties.

Heuristics 6

VBA property-stored shellcode loader critical OLE_VBA_PROPERTY_SHELLCODE_LOADER

VBA auto-exec macro takes the address (VarPtr) of a byte buffer decoded from a document property, marks memory executable (VirtualProtect/VirtualAlloc), and transfers control through a callback API (e.g. SetTimer/EnumWindows). The payload is hidden in the document properties rather than the macro source — the SVCReady loader pattern, a native shellcode runner rather than a parser CVE.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
CallByName call high OLE_VBA_CALLBYNAME

CallByName call
VBA reads reversed config from document properties high OLE_VBA_REVERSED_DOCPROP_CONFIG

VBA applies StrReverse to values read from the document's custom/built-in properties. Storing reversed configuration (URLs, CLSIDs, env-var names, payload names) in document properties keeps indicators out of the macro source — an obfuscation technique used by the SVCReady loader.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `1cb1749d957690b3c4ef7ef6d6d94aceea8919f14cfbde4c21dfd0bbd6a7d7b9`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	19434 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.