Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 ca7e404380abea44…

MALICIOUS

Office (OLE) / .DOC

111.9 KB
MD5: 3cfdf17977e713a21583fbb60f61ef95 SHA-1: 34d2b7132cb605f4f2916289579543e35bfccb1a SHA-256: ca7e404380abea4430256cf4bc123e7b2363e2f04cbfca174633f234b49dcc78
64 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1218.011 System Binary Proxy Execution: Rundll32

The sample contains an Excel 4.0 macro sheet, indicated by the OLE_XLM_AUTOOPEN heuristic. A high-severity heuristic also detected a LOLBin token sequence matching rundll32.exe with embedded URLs, suggesting an attempt to download and execute a payload. No VBA macros were extractable due to an unsupported format. The embedded URLs are the primary indicators of compromise.

Heuristics 4

  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Unsupported Office format for VBA extraction info OFFICE_FORMAT_UNSUPPORTED
    olevba could not extract VBA macros (AttributeError); format-agnostic byte-level scans still ran. Likely legacy, encrypted, or malformed OLE/OOXML — re-scanning the same bytes will yield the same outcome.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ordinateur.ogivart.us/editor/Qpo7OAOnbe/
    • http://old.liceum9.ru/images/0/
    • http://ostadsarma.com/wp-admin/pYk64Hh3z5hjnMziZ/
    • http://ordinateur.ogivart.us/editor/Qpo7OAOnbe

Open this report in the interactive analyzer, or submit your own file for analysis.