Office (OLE) malware analysis — malicious · e37cdf44b537f0c7

MALICIOUS

Office (OLE)

120.5 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel

MD5: d2a77c2544cc8621d1aa94712f04b8f2 SHA-1: 08f57b6c28c4c4e0532e1369c174acbd51af7627 SHA-256: e37cdf44b537f0c7d147517dd0910a7908be282cb1605d7111040cc551820e7f

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The VBA macro contains a CreateObject call to 'Shell.Application' and a ShellExecute API reference, indicating it's designed to execute commands. The script reconstructs the command 'powershell' and a URL 'http://www.example.com/payload.exe' to download and execute a second-stage payload. This is a common pattern for macro-enabled malicious documents.

Heuristics 3

Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `300fa969b08f831187d8ece119831aab4f57bbd57af2d8ce00b5ee5c33cef1e1`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1410 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.