Office (OLE) / .DOC malware analysis — malicious · b5d33f100cfaf608

MALICIOUS

Office (OLE) / .DOC

323.0 KB Created: 2020-12-14 13:34:00 Authoring application: Microsoft Office Word

MD5: 587faadcbc9befc18e0a30e113cfa7c8 SHA-1: 5b98b9e81a551f59a93b135e1920fd7c8a348829 SHA-256: b5d33f100cfaf6088a506807168093ece7872d028b05bd706158cbb1171a50a0

288 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell

The file is a malicious Microsoft Word document containing VBA macros. The presence of a 'Document_Open' macro and a 'GetObject' call indicates that malicious code is executed automatically when the document is opened. The ClamAV detection and heuristic firings strongly suggest this is a downloader. The extracted URLs are likely C2 servers for downloading further payloads.

Heuristics 9

ClamAV: Doc.Downloader.ChristmasGift-9845923-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.ChristmasGift-9845923-0
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://monacofieldson.co.uk/L8A5QV2mw.php
- http://electrocardsystems.com/plugins/vmcustom/specification/specification/tmpl/R674L7LjbwF.php
- https://cuencadistributions.com/wp-content/plugins/mailchimp-for-wp/vendor/bin/ekcBKiRsNXoj.php
- http://script.rentpayez.com/wwVbFeF1V2mFa.php
- https://kabiryogashramlimbdi.com/wp-includes/js/tinymce/plugins/charmap/7nem6JhxNGE.php
- https://richardsilk.com/wp-content/plugins/updraftplus/images/addons-images/Zk8Iv9hirxx0i.php
- https://pccreed.com/n0fBZhgWWCcFo.php
- https://sanjoseroofing.org/old/wp-content/uploads/2020/09/aRC84WdkOv16GY.php
- https://simba.simbapropertylistingsea.com/wp-content/themes/twentynineteen/sass/blocks/bVMQHi8npqSri.php
- https://loctraders.com/wp-includes/sodium_compat/src/Core/Base64/2qoGf0VX94dTFYv.php
- http://schemas.openxmlformats.org/drawingml/2006/main
- http://www.w3.org/1999/XSL/Transform

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `249d243d005dd786f23c0fdd2307ff71daa58e53b1541a4832c8dffa990eb613`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	35439 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 125 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.