MALICIOUS
148
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059.001 PowerShell
T1204.002 Malicious File
The presence of VBA macros and a CreateObject call strongly suggests malicious intent. The CreateProcess API reference indicates the macro attempts to launch an external process. The large slack space in the OLE document is also a common characteristic of macro-laden malicious files. Without further script analysis, the exact payload and delivery mechanism remain unclear, but the overall pattern points to a macro-based downloader.
Heuristics 5
-
Reference to CreateProcess API high SC_STR_CREATEPROCESSReference to CreateProcess API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 262,144 bytes but its declared streams total only 125,786 bytes — 136,358 bytes (52%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
CreateObject call high OLE_VBA_CREATEOBJCreateObject call
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
-
Environ() call (env variable access) low OLE_VBA_ENVIRONEnviron() call (env variable access)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas6604b7b9c0d7f0d7004090e793d434134188b53602545ad435e96792c1a214ea |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 219113 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.