Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9a8efd3d54e10092…

MALICIOUS

Office (OLE)

25.5 KB Created: 2018-05-10 23:37:29 Authoring application: Microsoft Excel First seen: 2019-02-26
MD5: 231a7ad366052695c3ac131d305a4251 SHA-1: 3da2b5ef7fbbe4f520c463be1a7bc75600f29eec SHA-256: 9a8efd3d54e10092454f8c0e686b8eb52b8935bbc4647af835b4bf61e07e3ecc
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information T1218.011 System Binary Proxy Execution: Bitsadmin

The sample is an Excel document with a lure to enable content, indicating a likely macro-based attack. Heuristics indicate the use of Wscript and bitsadmin, suggesting the document attempts to download and execute a second-stage payload from the URL http://www.sledinskaya.by/cli/Stt.exe. The presence of 'cmd /c @echo Set objShell = CreateObject("Wscript.Shell") >' further supports the execution of scripts.

Heuristics 5

  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Reference to bitsadmin (download) high SC_STR_BITSADMIN
    Reference to bitsadmin (download)
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.sledinskaya.by/cli/Stt.exe In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.