Office (OLE) / .DOC malware analysis — malicious · ab1b6a130a72a8fe

MALICIOUS

Office (OLE) / .DOC

189.5 KB Created: 2021-12-16 12:21:00 Authoring application: Microsoft Office Word

MD5: 25aa698dd41b00af0a6b49b76ae6b24b SHA-1: e4d5962d6b9eef2a136a4e2630a464aafdf05e85 SHA-256: ab1b6a130a72a8fe71e6c3e9e650dffa907b6f33e99ef667c6dc7c30cbe15ef0

62 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Office Word document containing VBA macros, specifically a Document_Open macro, which is a common delivery mechanism for malware. The macro code reconstructs the URL "https://sineko7.ru/d.doc" and attempts to open it. This indicates the document's purpose is to download and execute a second-stage payload. The benign URLs extracted are likely part of the document's internal structure and not indicative of malicious activity.

Heuristics 3

Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main
- http://schemas.openxmlformats.org/officeDocument/2006/bibliography
- http://schemas.openxmlformats.org/officeDocument/2006/customXml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `c62c28c80a7c684455e2e63ef5f9bf0f6c5a8b52745221765e4ee4feba8c97fc`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.