Office (OLE) / .DOCX malware analysis — malicious · 890000c5a7840a53

MALICIOUS

Office (OLE) / .DOCX

128.5 KB Created: 2022-02-10 21:41:00 Authoring application: Microsoft Office Word

MD5: c029a46419e87a087c64431b33a45ed5 SHA-1: 7e74607db51ae9c250b2ea6ffa127df9f94f4b6d SHA-256: 890000c5a7840a53a4c3aa83a5c886dee76494d1bbfcd805bec3367b1a067937

222 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros that utilize WScript.Shell and CreateObject to download and execute a DLL payload from an embedded URL. The script attempts to save the payload to a temporary file and then execute it using rundll32.exe. The document itself is presented as an employee handbook template to lure the user into opening it.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d2dc346198a7059036d6ba11d6c3e17a3edabfa6ee10b80cabc8eff5a0493e19`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.