Office (OLE) / .DOC malware analysis — malicious · fdc47e4b941e76d2

MALICIOUS

Office (OLE) / .DOC

33.5 KB Created: 2023-08-21 01:56:00 Authoring application: Microsoft Office Word First seen: 2023-08-22

MD5: f54548be8fdd4e0632464213a88975eb SHA-1: cad255dd52ee72d0460c3cce8bf520bbc32616ef SHA-256: fdc47e4b941e76d24e81652d97745c885ee7165d2d08d97b7b4098d1afa15485

130 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The sample contains VBA macros that automatically execute upon opening. The AutoOpen subroutine constructs and executes a PowerShell command to download and run a script from '127.0.0.1:8000/reshell.ps1'. This indicates a downloader or initial access attempt.

Heuristics 5

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
VBA project contains no executable statements low OLE_VBA_MACROS

Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `dadcf3844a20d3c777c80d696b935c831998f1ffae91fde3b3132da4e0c9d16a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.