Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 795469e3d20d8b1e…

MALICIOUS

Office (OLE) / .DOC

575.5 KB Created: 2021-11-03 09:08:00 Authoring application: Microsoft Office Word
MD5: 3247dab6d560e5cf05bbe610c3f92da6 SHA-1: 824cd25d1cc8b8092f90dc6dfc80f867caae49eb SHA-256: 795469e3d20d8b1e85816f14cd122796ca9dfe2947a4c9fe1464d62900f10d52
244 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro that executes automatically upon opening. This macro searches for specific files and attempts to rename them to 'zoro.doc', which then triggers another macro ('pppx') to open it. This suggests a downloader or dropper functionality, likely intended to deliver a secondary payload. The ClamAV detection 'Doc.Dropper.Valyria-10001413-0' further supports this assessment.

Heuristics 8

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • ClamAV: Doc.Dropper.Valyria-10001413-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Valyria-10001413-0
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.microsoft.com/office/2006/encryption
    • http://schemas.microsoft.com/office/2006/keyEncryptor/password
    • http://schemas.microsoft.com/office/2006/keyEncryptor/certificate
    • http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
0e4a9583f8b4ecec4080dd466152a07f55057af2a0cccdec725579f3d1d20f17		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2609 bytes
ole10native_00.bin
cb49528acdad2b047cec50a87b2a6ef9b0e349856ba3b1fcc0323db740537bcb		 ole-package OLE Ole10Native stream: ObjectPool/_1697410523/Ole10Native 412451 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.99, consistent with packed or encrypted content.

Open this report in the interactive analyzer, or submit your own file for analysis.