Office (OLE) malware analysis — malicious · 6dbd167394f71ffe

MALICIOUS

Office (OLE)

85.0 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel

MD5: cc7b1755987f9193f27f54fd8f67126a SHA-1: 18b1337981d5901ce18b8746dc5662f3ec9a763a SHA-256: 6dbd167394f71ffe2f1ade46aeab61450f59ae95c17c498b4a97900d37b2235f

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an Excel file containing VBA macros that leverage the CreateObject function to execute a command. The script concatenates strings to form the command, which appears to be a download and execution command. The specific URL or payload is not directly visible, but the intent is to download and run a second-stage payload.

Heuristics 3

Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6cdc8295943cb3426d1b759d1f97f026fb1de0598fe2cc194c4a7ce55e15bf0f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.