Office (OLE) / .DOC malware analysis — malicious · 734a56f1e63dcea0

MALICIOUS

Office (OLE) / .DOC

147.5 KB Created: 2020-03-23 21:08:00 Authoring application: Microsoft Office Word

MD5: 4a401d041e4208772c05deccf0b614bb SHA-1: 03f669bf1bb6e40f5677f6a65c6f7583cc0f3fcf SHA-256: 734a56f1e63dcea04a5454d009af25002b3fe58bb493eeb3ce7f77112b6b9776

272 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is a malicious Word document containing VBA macros. The document body presents a fake invoice, instructing the user to enable macros to view details, a common lure. The 'Document_Open' macro is obfuscated and uses CreateObject to execute a second-stage payload, likely a downloader. The presence of 'CreateObject' and 'Shell' execution tokens in the p-code auto-exec loader, combined with the obfuscation, strongly suggests a downloader or dropper functionality.

Heuristics 10

Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `61ee21451fe8401ce4d7c172ca6fbf401574982c09b2639b288fd1b4603a02dc`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	15057 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.