Office (OLE) / .DOCX malware analysis — malicious · e04b03e82077329b

MALICIOUS

Office (OLE) / .DOCX

259.5 KB Created: 2020-05-16 15:58:00 Authoring application: Microsoft Office Word

MD5: 9a8e6b60b74bc09ec941ea341b6f85f2 SHA-1: 3769f0204c8b6e9beb5a9cad05840c0f981e20f1 SHA-256: e04b03e82077329bfcc5b0aae31a931b6306927b39fac83104fc81efc92d7b59

202 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1105 Ingress Tool Transfer

The file is a malicious Office document containing a Document_Open macro that acts as a shellcode callback loader. This loader utilizes VirtualAlloc and a decoder API to execute a large blob of shellcode. The presence of the 'macros.bas' artifact and the 'OLE_VBA_SHELLCODE_CALLBACK_LOADER' heuristic strongly indicate that the macro's primary purpose is to download and execute a second-stage payload. The embedded URL was confirmed benign, so no IOCs were extracted from it.

Heuristics 7

VBA shellcode callback loader critical OLE_VBA_SHELLCODE_CALLBACK_LOADER

VBA auto-exec macro allocates executable memory, decodes a large encoded blob into that memory, and invokes it through a callback API such as LineDDA/Enum*/CallWindowProc/CreateThread. This is a native payload loader rather than a document-parser CVE primitive.
ClamAV: Doc.Dropper.Shellex-8226825-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Shellex-8226825-0
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC

Reference to VirtualAlloc API
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `3b8a93c62b30d50f962b9517919b3101c5fef3ed066456ed5a590ad87e0b114a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	11171 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 9 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.