Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e89ca27b22ae588a…

MALICIOUS

Office (OLE)

99.8 KB Created: 2019-01-14 17:54:00 Authoring application: Microsoft Office Word First seen: 2020-05-25
MD5: fe47a543079ecfcd2a187bb0a547d261 SHA-1: 497b6906022734a752846746968531696ffa9585 SHA-256: e89ca27b22ae588a313dd64a514fa910e07777df1ae4f861466d868e0136ebde
110 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is a malicious Office document containing obfuscated URLs and a legacy WordBasic auto-exec marker ('autoopen'). The presence of VBA macros and the 'SC_STR_WSCRIPT' heuristic suggest the document is designed to execute malicious code, likely by redirecting the user to one of the embedded, obfuscated URLs. The VBA code itself does not contain executable statements, but the overall structure and heuristics point to a macro-based downloader or phishing lure.

Heuristics 5

  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 102,144 bytes but its declared streams total only 46,315 bytes — 55,829 bytes (55%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://r]_-bet]$.om/ In document text (OLE body)
    • http://m]`hur]]rts$.om/##m29mGm@http://www$7i7]journ]l$.om/D1o40Dmemk@http://li3numpolsk]$.om/lCGBPPq{MY@http://w]liw]lo$.om/urHKt1`sw3f$Split(w3f@w3f);+Br][ili]nRe]ll=w3fTriplebu77ere`Ew3f;+7ullr]n3e#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1032 bytes
SHA-256: 891c1371263eb98d5768ec0cef7543fd169e3f458fce2c8bb5fc467310f00670
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "PersonalLoanAccountV"

Attribute VB_Name = "ClothingIndustrialW"

Attribute VB_Name = "GamesElectronicsw"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "AwesomePlasticSaladf"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "Cambridgeshirer"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Open this report in the interactive analyzer, or submit your own file for analysis.