Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 e9c21b4baa1a3a38…

MALICIOUS

Office (OLE) / .DOC

7.5 KB First seen: 2022-11-23
MD5: 7f0ac80f94e5919455a1ccf644dceb40 SHA-1: 72bbb508f461c42f0d2b70ea5b30488ffbc3efaf SHA-256: e9c21b4baa1a3a3812c09faabb10908083e3c6bd397d374d7848f5121279d4a1
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File T1140 Deobfuscate or Obfuscate

The sample contains a VBA macro that is triggered by the Document_Open event. This macro utilizes GetObject to instantiate the dangerous COM class WScript.Shell, and employs a shellcode loader technique by reading content from a document property. The script's intent is to execute arbitrary code, likely downloading and running a secondary payload, which is a common initial access or execution technique for malware.

Heuristics 5

  • VBA property-stored shellcode loader critical OLE_VBA_PROPERTY_SHELLCODE_LOADER
    VBA auto-exec macro takes the address (VarPtr) of a byte buffer decoded from a document property, marks memory executable (VirtualProtect/VirtualAlloc), and transfers control through a callback API (e.g. SetTimer/EnumWindows). The payload is hidden in the document properties rather than the macro source — the SVCReady loader pattern, a native shellcode runner rather than a parser CVE.
  • VBA instantiates a dangerous COM class by CLSID critical OLE_VBA_GETOBJECT_CLSID_DANGEROUS
    VBA uses GetObject("new:{CLSID}") to instantiate an execution/scripting-capable COM class by its raw CLSID, avoiding the CreateObject ProgID that name-based detection keys on.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e5c488e43b87a8b9e37048c66ff722e9cc35f73444ca6934e6e0a03f9957499a
vba-macro oletools.olevba.extract_macros (decoded VBA source) 3114 bytes