Office (OLE) / .DOC malware analysis — malicious · d24ce045246fd4ac

MALICIOUS

Office (OLE) / .DOC

58.0 KB Created: 2015-12-10 11:14:00 Authoring application: Microsoft Office Word First seen: 2022-11-25

MD5: a3b8526c34e0bf10c10fd0063f1c72bf SHA-1: 6d3bab315b335ef50824b2b8c6bc4015d592fda8 SHA-256: d24ce045246fd4ac7e959dbf82a4a16ae445b014b0d70319c2506a53183a3a7d

242 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1105 Ingress Tool Transfer

The file contains obfuscated VBA macros designed to execute code. The 'autoopen' subroutine and the use of CreateObject and CallByName indicate a loader mechanism. The script attempts to download a payload from a URL, which is a common technique for delivering secondary malware.

Heuristics 7

Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
CallByName call high OLE_VBA_CALLBYNAME

CallByName call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6d1762dd36f1d0d461ba587396f477bfcb1d313c57f8148d200d36cf407bb4a1`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	35716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.