Office (OLE) / .DOC malware analysis — malicious · 8b19aea82bee7f1e

MALICIOUS

Office (OLE) / .DOC

57.5 KB Created: 2017-05-11 08:56:00 Authoring application: Microsoft Office Word First seen: 2023-08-04

MD5: 2430ede5871da3f4d58ce56282d4dea5 SHA-1: 3bfcf1a272df6134d4e2adc266ccc6735338c35a SHA-256: 8b19aea82bee7f1e1a41913ba22927895f69b87d3dfbf1221348e0f8cb0b8241

242 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample is a malicious Office document containing VBA macros. The 'autoopen' macro is triggered upon opening, and it contains logic that ultimately calls the Shell() function. The document body explicitly instructs the user to 'Enable Editing' and 'Enable Content', a common social engineering tactic to bypass macro security. The VBA script appears to be obfuscated but ultimately attempts to execute a command.

Heuristics 7

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV: Doc.Dropper.Agent-6311574-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6311574-0
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `5e8a7fc6b22a3164040bbd22fc32d86e5bd8ef8ba311d768c2c37335ff6d8cb1`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1901 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.