Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 e14ae0225c6d57de…

MALICIOUS

Office (OLE) / .DOC

192.5 KB Created: 2020-12-07 13:31:00 Authoring application: Microsoft Office Word
MD5: 8f1aec1a18c899e152ed78601cfb02f4 SHA-1: d1acd56eaa005e7a1c2a0b1535739a5710bf3024 SHA-256: e14ae0225c6d57dec72fbac86753e0a459b047c5f9c540ba0cebc79d3207d6aa
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The presence of a Document_Open macro, GetObject calls, and references to Windows Script Host strongly indicate malicious intent. The macro is likely designed to download and execute a second-stage payload from one of the embedded URLs. The obfuscated VBA code and the nature of the URLs suggest a downloader or droppper functionality.

Heuristics 8

  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://factory.akl.today/6uSMMukJ.php
    • https://Spidsolutions.com/vendor/aferrandini/phpqrcode/cache/BWoo3hBwVEB.php
    • http://utv1.enliden.net/wp-includes/sodium_compat/namespaced/Core/ChaCha20/yqxc0YtjhvHQ.php
    • https://hotelbooking.muhashin.com/wp-content/plugins/goodlayers-importer/images/NRC3HGfmpAeXt.php
    • http://narayan.website-demos.net/uYLP5cJ2C.php
    • https://iltuoteamadvertising.it/wp-content/uploads/2020/02/IE0gQoxjCDElkKq.php
    • http://lebfinder.fr/FdCtcVXXoRl5.php
    • https://www.keeptalking.gr/en/wp-content/plugins/page-builder/class/SvlYLuLTgj.php
    • https://deserta.ae/wp-content/plugins/sg-cachepress/core/Activator/tMMu7nGCya36k.php
    • https://alegsanatate.ro/QQv2qead.php
    • http://acceso.duward.es/class/dat/pdfClass/font/makefont/wyT7jLM2xYghVB.php
    • https://plus.inovento.com/assets_old/plugins/fancybox/demo/NeueuKvQJfN.php
    • https://atpcsm.be/wp-content/themes/itheme2/uploads/bg/7dcOpKBYf8Loh0.php
    • http://sevenseasinternational.in/wp-includes/js/tinymce/themes/inlite/wYhuZMU1c.php
    • http://patsisgroup.gr/wp-content/plugins/wordpress-seo/js/dist/HXz3vq4fWCLOa.php
    • https://gmtrip.resultaweb.com.br/documentacao/clientes/rafaelagenciaturismo/contrato/emissao/dOkAwT1T.php
    • http://assets.helloguide.com/images/galleries/outdoor-activities/canyoning/xHVHYMlBDzi.php
    • https://makeupme.co.za/maktest2/wp-content/uploads/2019/07/oaSWIpgC2.php
    • https://karakas.com.gr/edHep7KkeO7.php
    • https://timeon.in/wp-includes/js/tinymce/plugins/charmap/W3wvvkEd.php
    • https://uniqaforforeigners.cz/wp-content/plugins/wordpress-seo/js/dist/8K3NWRnlIqyQrm.php
    • http://api.test.mastertube.com/css/font/ZIiBP6mw8JZ5S3V.php
    • https://marshallsremodelingco.com/wp-content/plugins/elementor/data/base/aHePs90P.php
    • https://das-ohr-am-frankfurter-tor.de/wp-content/uploads/2020/01/jvfLNAcQkdUD5E.php
    • https://goodsmaroc.achusweb.com/wp-content/themes/Divi/includes/builder/p2JDjZkSG62.php
    • https://mijn3.easyofficeonline.nl/bundles/sensiodistribution/webconfigurator/css/oXQ6O5r9ChR.php
    • https://abrimmo49.fr/wfKFjffFrV.php
    • https://cdn.examdunia.com/site/js/jquery.fileupload/vendor/EDezZkK0.php
    • http://schemas.openxmlformats.org/drawingml/2006/main
    • http://www.w3.org/1999/XSL/Transform

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
53b8eaa9b51f41d64b80be85878c3f30da611e9f5d627ff1e31f46fe04d2a0d2		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 62554 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 125 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.