Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 990bcb268d5eab02…

MALICIOUS

Office (OLE)

83.5 KB Created: 2018-04-25 21:21:00 Authoring application: Microsoft Office Word
MD5: 96a0a32c808580958c77ff0aeaeb5bf3 SHA-1: 007660379b96cf3e0bb8b99fc61e8e7befe2de0b SHA-256: 990bcb268d5eab02e71895d0fc72975749105a18950df704cca4ec53ae122433
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample contains VBA macros, including an AutoOpen subroutine, which is a common technique for executing malicious code upon opening the document. The script utilizes CreateObject to instantiate 'Scripting.FileSystemObject' and 'Shell.Application', indicating an intent to write files and execute commands. Specifically, it appears to write content from 'zvhuizq.Controls(0).Caption' to a file specified by 'zvhuizq.Controls(1).Value' and then execute that file. This strongly suggests the document is a downloader for a second-stage payload.

Heuristics 7

  • Reference to PowerShell high SC_STR_POWERSHELL
    Reference to PowerShell
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
af4ae1ee8091b5915475220ddbb218376a39b56d28364a662319d34bfae9223a		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2007 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.