Office (OLE) / .DOCX malware analysis — malicious · ecd9057da9648555

MALICIOUS

Office (OLE) / .DOCX

55.0 KB Created: 2021-06-08 15:53:00 Authoring application: Microsoft Office Word

MD5: c6af11c95909bea0e3ac1124383e8979 SHA-1: d00307046e54d33e9bc6dc5ed0489533506b8967 SHA-256: ecd9057da96485553a0d378640ab3930e23641e5c34aa82a3dad9898f7be0198

270 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell

The sample is a malicious DOCX file containing VBA macros. Heuristics indicate the use of WScript.Shell and the Shell() function, which are commonly used to download and execute additional payloads. The presence of these functions strongly suggests an intent to compromise the user's system by running external code. No specific family could be identified.

Heuristics 8

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `486025ddff355c2a515ff027e7cb9d7c92c50f0c255a4cc3c1267068e3163e7c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	20016 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 37 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.