Office (OLE) / .DOC malware analysis — malicious · 874f40b624c0976b

MALICIOUS

Office (OLE) / .DOC

1.01 MB Created: 2020-10-05 15:45:00 Authoring application: Microsoft Office Word

MD5: 540f61351cd1c84ab345f0c0ab73f1b1 SHA-1: e4a87dad3b700ea1639b395f712b7f51c020d9d1 SHA-256: 874f40b624c0976b3c70263a40e5ed4e831192e07fa93415f88268b47d78187a

240 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is a Microsoft Office document containing a significant amount of VBA macro code. Heuristics indicate the presence of an Auto_Close macro that uses the Shell execution token, suggesting it's designed to run external commands upon document closure. The macro code itself is obfuscated, but the presence of 'Wscript' references and the overall structure point towards a downloader or initial execution stage for further malicious activity. No specific family could be identified, but the techniques used are common for initial access.

Heuristics 7

ClamAV: Doc.Malware.Generic-9775351-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Generic-9775351-0
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `31dbf11c68f4630ae88daad88721483cc240c540a489617485e4533eac52fb30`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	78221 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 9 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.