Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 c166ed4853474046…

MALICIOUS

Office (OLE) / .DOC

239.0 KB Created: 2021-02-23 10:15:00 Authoring application: Microsoft Office Word
MD5: 28ed7acbf9cf3bec25a6b8c9b7b46e33 SHA-1: 0c139d079c5c78f782ea6b3fe3915f1364a6ba7f SHA-256: c166ed4853474046c299c5374d2a791597e758fa9cce4a4fd08d2f9c3f018890
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1218 System Binary Proxy Execution T1105 Ingress Tool Transfer

The sample contains VBA macros, including a Document_Open macro, which is a common delivery mechanism. Heuristics indicate the use of WinExec and certutil, suggesting the macros are designed to download and execute a second-stage payload. The use of LOLBins further supports this. No specific family could be identified.

Heuristics 6

  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Reference to certutil (download/decode) high SC_STR_CERTUTIL
    Reference to certutil (download/decode)
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
3ffded6ec29341c015d4df6980078080f3ba667f1713de08720e51c83059528d		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1418 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.