Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 fd3af0e7890546cc…

MALICIOUS

Office (OLE) / .DOC

152.5 KB Created: 2021-04-05 11:57:00 Authoring application: Microsoft Office Word
MD5: 6c27902679913bb13e0732735ea73ddb SHA-1: b1674649dee5ebb75f8e6c4cd8e165714ea4d444 SHA-256: fd3af0e7890546cc6e6ee828df5a31a4c88c587f968b0298a672b703bf71b7e4
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059.003 Windows Command Shell

This malicious document contains VBA macros, including an AutoOpen macro, which are designed to execute code upon opening. The heuristics indicate the use of WinExec and cmd.exe, suggesting the macro attempts to run external commands. The presence of CVE-2012-0158 points to an exploit targeting a specific vulnerability in Microsoft Office components. The overall intent appears to be the execution of a second-stage payload.

Heuristics 7

  • MSCOMCTL.ListView — CVE-2012-0158 high CVE likely CVE_2012_0158
    MSCOMCTL.ListView — CVE-2012-0158
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • cmd.exe reference in VBA high OLE_VBA_CMD
    cmd.exe reference in VBA
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
c04507977dd2ea20d86e147bf775add94260e43cb21b1d15db27f0c2bf8d2b70		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.