Office (OLE) / .DOC malware analysis — malicious · b2600ac9b83e5bb5

MALICIOUS

Office (OLE) / .DOC

77.0 KB Created: 2019-04-04 08:03:00 Authoring application: Microsoft Office Word

MD5: bfcec5556afffcb3f31754f3312d2ec7 SHA-1: 33e846e8b48013fef09bf9292dc7978e02a5b6ac SHA-256: b2600ac9b83e5bb5f3d128dbb337ab1efcdc6ce404adb6678b062e95dbf10c93

428 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File T1059.003 Windows Command Shell

The file is a malicious Microsoft Word document containing VBA macros. The document body instructs the user to 'Enable Content', a common social engineering tactic to bypass macro security. Heuristics indicate the presence of AutoOpen macros, CreateObject, GetObject, and references to cmd.exe, suggesting the execution of malicious code. The ClamAV detection 'Doc.Trojan.Xshell-6923080-0' further confirms its malicious nature. No specific IOCs like URLs or file paths were extracted from the provided evidence.

Heuristics 13

ClamAV: Doc.Trojan.Xshell-6923080-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Xshell-6923080-0
Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://schemas.openxmlformats.org/drawingml/2006/main
- http://schemas.microsoft.com/developer/msbuild/2003

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `96921374767cf7c11e3296b90bfb7660a3aea866a8b28af5d13fa2498541c246`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7347 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.