MALICIOUS
88
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1204.002 Malicious File
The file contains a reference to the CreateProcess API, indicating an attempt to launch an external process. Although no VBA macros were found to be executable, the presence of an embedded URL suggests a potential download and execution vector. The document body contains obfuscated strings and what appears to be a reference to an HTA file, further supporting the likelihood of a malicious payload delivery.
Heuristics 4
-
Reference to CreateProcess API high SC_STR_CREATEPROCESSReference to CreateProcess API
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 84,992 bytes but its declared streams total only 42,689 bytes — 42,303 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
VBA project contains no executable statements low OLE_VBA_MACROSDocument contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://investor.msn.com/external/excel/quotes.asp?SYMBOL=[
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas73fe284b1e885bd0405ecb421b1224021163ce4aa3bca30e5a2deb64f9916b3c |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 684 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.