Malicious Office (OLE) — malware analysis report

Heuristics 11

• Legacy Flash object embedded in Office document high CVE related OFFICE_LEGACY_SWF_OBJECT
  Office document embeds a ShockwaveFlash ActiveX object with a legacy SWF version (6). This is old Flash-in-Office exploit-family evidence, not a specific Flash CVE without SWF tag-level validation.
• Embedded PE executable critical OLE_EMBEDDED_EXE
  MZ/PE header found inside document — possible embedded executable
• Embedded Adobe Flash (SWF) in OLE document critical OFFICE_EMBEDDED_SWF
  Document contains an embedded Adobe Flash (SWF) object. Vulnerabilities such as CVE-2018-4878 and CVE-2018-15982 involved Flash objects embedded in Office files. Adobe Flash has been end-of-life since December 2020.
• Ole10Native package drops an auto-executable payload critical OFFICE_PACKAGE_RISKY_FILE
  OLE Package displayName or fullPath ends in a directly auto-executable extension (a runnable binary or a script the default shell host runs on double-click). Embedding such a payload inside an Office document has no benign authoring use — it is a malware-delivery dropper.
• Heap-spray pattern detected high SC_HEAP_SPRAY
  Repeated 0x07 bytes found
  Disassembly

  Attempted x86 opcode disassembly

  000D5EB1  07                pop es
  000D5EB2  07                pop es
  000D5EB3  07                pop es
  000D5EB4  07                pop es
  000D5EB5  07                pop es
  000D5EB6  07                pop es
  000D5EB7  07                pop es
  000D5EB8  07                pop es
  000D5EB9  07                pop es
  000D5EBA  07                pop es
  000D5EBB  07                pop es
  000D5EBC  07                pop es
  000D5EBD  07                pop es
  000D5EBE  07                pop es
  000D5EBF  07                pop es
  000D5EC0  07                pop es
  000D5EC1  07                pop es
  000D5EC2  07                pop es
  000D5EC3  07                pop es
  000D5EC4  07                pop es
  000D5EC5  07                pop es
  000D5EC6  07                pop es
  000D5EC7  07                pop es
  000D5EC8  07                pop es
  000D5EC9  07                pop es
  000D5ECA  07                pop es
  000D5ECB  07                pop es
  000D5ECC  07                pop es
  000D5ECD  07                pop es
  000D5ECE  07                pop es
  000D5ECF  07                pop es
  000D5ED0  07                pop es
  000D5ED1  07                pop es
  000D5ED2  07                pop es
  000D5ED3  07                pop es
  000D5ED4  07                pop es
  000D5ED5  07                pop es
  000D5ED6  07                pop es
  000D5ED7  07                pop es
  000D5ED8  07                pop es
  000D5ED9  07                pop es
  000D5EDA  07                pop es
  000D5EDB  07                pop es
  000D5EDC  07                pop es
  000D5EDD  07                pop es
  000D5EDE  07                pop es
  000D5EDF  07                pop es
  000D5EE0  07                pop es
  000D5EE1  07                pop es
  000D5EE2  07                pop es
  000D5EE3  07                pop es
  000D5EE4  07                pop es
  000D5EE5  07                pop es
  000D5EE6  07                pop es
  000D5EE7  07                pop es
  000D5EE8  07                pop es
  000D5EE9  07                pop es
  000D5EEA  07                pop es
  000D5EEB  07                pop es
  000D5EEC  07                pop es
  000D5EED  07                pop es
  000D5EEE  07                pop es
  000D5EEF  07                pop es
  000D5EF0  07                pop es
  000D5EF1  07                pop es
  000D5EF2  07                pop es
  000D5EF3  07                pop es
  000D5EF4  07                pop es
  000D5EF5  07                pop es
  000D5EF6  07                pop es
  000D5EF7  07                pop es
  000D5EF8  07                pop es
  000D5EF9  07                pop es
  000D5EFA  07                pop es
  000D5EFB  07                pop es
  000D5EFC  07                pop es
  000D5EFD  07                pop es
  000D5EFE  07                pop es
  000D5EFF  07                pop es
  000D5F00  07                pop es
  000D5F01  07                pop es
  000D5F02  07                pop es
  000D5F03  07                pop es
  000D5F04  07                pop es
  000D5F05  07                pop es
  000D5F06  07                pop es
  000D5F07  07                pop es
  000D5F08  07                pop es
  000D5F09  07                pop es
  000D5F0A  07                pop es
  000D5F0B  07                pop es
  000D5F0C  07                pop es
  000D5F0D  07                pop es
  000D5F0E  07                pop es
  000D5F0F  07                pop es
  000D5F10  07                pop es

• Reference to CreateProcess API high SC_STR_CREATEPROCESS
  Reference to CreateProcess API
• Reference to LoadLibrary API high SC_STR_LOADLIBRARY
  Reference to LoadLibrary API
• Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
  Reference to GetProcAddress API
• VBA macros detected medium OLE_VBA_MACROS
  Document contains VBA macro code
• Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
  One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://publicaties.hbd.nl/bid/ In document text (OLE body)

  • http://taekemdejong.nl/Publications/2009/Territory59.pdfIn document text (OLE body)
  • http://taekemdejong.nl/In document text (OLE body)
  • https://lab1.macromedia.com/cgi-bin/flashdownload.cgiIn document text (OLE body)
  • https://www.macromedia.com/bin/flashdownload.cgiIn document text (OLE body)
  • http://www.macromedia.com/support/flashplayer/sys/In document text (OLE body)
  • http://team.bk.tudelft.nl/Publications/2007/Territory/TerritoryIn document text (OLE body)
  • http://www.cbs.nl/infoserviceIn document text (OLE body)
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.