Valyria — Office (OLE) / .DOC malware analysis

Static analysis result for SHA-256 7f3c8bf4b5d1cc28…

MALICIOUS

Office (OLE) / .DOC

115.0 KB Created: 2020-11-25 15:45:00 Authoring application: Microsoft Office Word1 Normal.dotm@
MD5: eb2b542cc9e29056eee7825adc556fad SHA-1: 8c0608583d2167078ca3644c0eaddc577646057f SHA-256: 7f3c8bf4b5d1cc28beaf09f5f31b8fad2d353b12484185097fdf8bf86fc55e30
240 Risk Score

Malware Insights

Valyria · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1059 Command and Scripting Interpreter T1105 Ingress Tool Transfer T1071.001 Web Protocols T1059.003 Windows Command Shell

The file contains VBA macros that utilize CreateObject, VirtualAlloc, WriteProcessMemory, and CreateProcess APIs, indicating an attempt to download and execute a secondary payload. The ClamAV detection name 'Doc.Downloader.Valyria-10004543-0' strongly suggests the Valyria family and a downloader functionality. The document body's prompt to 'Click the button below to load contents' is a common social engineering lure to trick users into enabling macros.

Heuristics 7

  • Reference to WriteProcessMemory API critical SC_STR_WRITEPROCESSMEMORY
    Reference to WriteProcessMemory API
  • ClamAV: Doc.Downloader.Valyria-10004543-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Valyria-10004543-0
  • Reference to CreateProcess API high SC_STR_CREATEPROCESS
    Reference to CreateProcess API
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://docs.microsoft.com/en-us/windows/desktop/api/winbase/ns-winbase-_startupinfoexa#remarks

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
cf206811720fa33df3b3f6143dc032c88ae8702de0f1277e6d81776cb532baa6		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 29030 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.