Office (OLE) / .DOC malware analysis — malicious · c1c7dd7453f5ccfa

MALICIOUS

Office (OLE) / .DOC

62.0 KB Created: 2015-05-15 06:12:00 Authoring application: Microsoft Office Word First seen: 2022-11-25

MD5: 695e9c7209656120eaaeadf4a9a8a4ed SHA-1: 5af02d417c23a924658cbd4982ac84811929e208 SHA-256: c1c7dd7453f5ccfa9bb2004a16235f255eb24bd8db177c7b22fa11585f218ef7

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1071.001 Web Protocols T1105 Ingress Tool Transfer T1204.002 Malicious File T1059.003 Windows Command Shell

The sample contains an obfuscated VBA macro that executes upon opening. The macro uses CreateObject to instantiate objects for HTTP requests and file operations. It downloads a file from "http://bbs.sjzu.org/34/140.exe" and saves it to disk as "C:\Windows\TEMP\strad1.6.exe", then executes it. This indicates a downloader or droppper functionality.

Heuristics 6

VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC

VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b6132e9005b5331a45ce172e343c9bb6db784feb1ea94f2e4dde9d869ff72462`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4883 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.