Office (OLE) malware analysis — malicious · c79bbc43d474a404

MALICIOUS

Office (OLE)

616.5 KB Created: 1601-01-01 00:00:00 Authoring application: Microsoft PowerPoint

MD5: 9e765e0c34f8c39a0d8750698b0771fa SHA-1: be3764d50a6ad201db0a052dae8daad3b8224709 SHA-256: c79bbc43d474a4045a32188bfce9bc1789872bd16b6c116b7e5c5fed54597520

300 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1105 Ingress Tool Transfer T1055 Process Injection T1059.003 Windows Command Shell

The sample exhibits high-confidence heuristics for API hash resolution and PEB access, indicating sophisticated evasion techniques. Crucially, it references the URLDownloadToFile API, suggesting an intent to download additional content. Furthermore, a suspicious cmd.exe invocation with an execution flag was detected, likely to launch the downloaded payload. The embedded URL 'http://bmwftp.blogdns.net:8080/nnn/' is the most probable source for this secondary stage.

Heuristics 8

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
x86 GetPC stub (CALL $+5; POP EAX) high SC_GETPC_CALL

x86 GetPC stub (CALL $+5; POP EAX)
PEB access via FS segment (x86) high SC_PEB_ACCESS

PEB access via FS segment (x86)
PEB API-hash resolver high SC_API_HASH_RESOLVER

PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
Suspicious cmd.exe invocation with execution flag high SC_STR_CMD

Suspicious cmd.exe invocation with execution flag
Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://bmwftp.blogdns.net:8080/nnn/#

Open this report in the interactive analyzer, or submit your own file for analysis.