Office (OLE) / .DOC malware analysis — malicious · 90df87274d669b23

MALICIOUS

Office (OLE) / .DOC

173.0 KB Created: 2021-11-30 06:51:00 Authoring application: Microsoft Office Word

MD5: 3fd39d731f01a6e2d6f414dd68d18bcb SHA-1: 923672be38654a0a1ae205defa97a7f4c25b4a32 SHA-256: 90df87274d669b237e651489b46d78d5f086e4eefb5f4997444b6108e9094ad8

62 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The document contains VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. The script reconstructs a URL 'http://diuar5.ru/' and attempts to download a file named 'help.doc'. This indicates the document's purpose is to act as a downloader for a secondary malicious payload. The presence of the Document_Open macro and the URL construction strongly suggest malicious intent.

Heuristics 3

Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/bibliography
- http://schemas.openxmlformats.org/officeDocument/2006/customXml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `57439e7b3dbf931d4df782141c52baaed108b49288aa86cebe095ed109085326`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.