Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 67938de2e58c02df…

MALICIOUS

Office (OLE)

115.5 KB Created: 2010-01-05 04:41:00 Authoring application: Microsoft Word 11.3.5
MD5: c400fd0e1916d6bc8753ee1cd6e2270e SHA-1: 5ea8d8ef90e7aa2f979c41e7fe9c503f400f5642 SHA-256: 67938de2e58c02df4eaf8e28fc269c8ca7a319e29df120efd33d0a717fdd18bc
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains VBA macros that utilize the Shell() function, indicating an attempt to execute external commands. The macro code explicitly constructs commands to connect to the IP address 209.201.88.110 via FTP, upload a file named 'c:\hsf????.sys', and then execute 'c:\netldx.vxd'. This strongly suggests the macro is a downloader for a second-stage payload.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • ClamAV: Doc.Trojan.Marker-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-5
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.bced.gov.bc.ca/perf_stands/
    • http://www.bced.gov.bc.ca/irp/
    • http://www.bced.gov.bc.ca/primary_program/
    • http://www.teach.educ.ubc.ca/bachelor/pdfs/BEd_Guidelines_Handbook_

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
a0b817cc5e0aa3a99d224ec0ad7b278bb043bcae892c417568d6c9f8be5c8383		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 5763 bytes
Detection
ClamAV: Doc.Trojan.Marker-5
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.