MalwareBazaar Database

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

OLE dump

MalwareBazaar was able to identify 121 sections in this file using oledump:

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Intelligence

File Origin

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Passport & Credit Card Authorization(1).docx

Verdict:

Malicious activity

Analysis date:

2022-06-09 04:55:00 UTC

Tags:

macros generated-doc

Link:

https://app.any.run/tasks/1a5e2a7c-ed19-4587-a5de-aabb39e0ae2b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Malicious

Verdict:

Malicious

File type:

application/msword

Has a screenshot:

False

Contains macros:

True

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.ScriptBuilderYouShouldBeDancing.20220608.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Searching for synchronization primitives

Launching a process

Creating a file

Creating a process with a hidden window

Creating a process from a recently created file

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Word File with Embedding Objects

Link:

https://app.docguard.net/ccc8d5aa5d1a682c20b0806948bf06d1b5d11961887df70c8902d2146c6d1481/results/dashboard

Payload URLs

URL

File name

http://www.asianexportglass.shop/p/25.html

Microsoft_Excel_97-2003_Worksheet.xls

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

macros macros-on-close mshta wscript

Link:

https://www.filescan.io/uploads/62a17d445dc88d35716deaf7/reports/e76be18f-42a4-437a-87e6-05afc076ca8e/overview

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

2.6/10

Score Malicious:

27%

Score Benign:

73%

Link:

https://www.malware.ai/gui/files/?id=63e265dd-254a-4903-8998-07c6366438d5

InQuest SUSPICIOUS

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/ccc8d5aa5d1a682c20b0806948bf06d1b5d11961887df70c8902d2146c6d1481

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro with File System Write

Detected macro logic that can write data to the file system.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

expl.evad.troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1009644

Signature

.NET source code contains very large array initializations

Connects to many ports of the same IP (likely port scanning)

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (creates forbidden files)

Document exploit detected (process start blacklist hit)

Drops PE files with a suspicious file extension

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Installs a global keyboard hook

Malicious sample detected (through community Yara rule)

Microsoft Office drops suspicious files

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ccc8d5aa5d1a682c20b0806948bf06d1b5d11961887df70c8902d2146c6d1481/

ReversingLabs TitaniumCloud Document-Word.Downloader.Powdow

Threat name:

Document-Word.Downloader.Powdow

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-06-08 22:39:16 UTC

File Type:

Document

Extracted files:

183

AV detection:

11 of 26 (42.31%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ztenlks5djucyifqqbuurpyg2g25cglbrb67odejaljbi3dncsaq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/220609-fj4s5sdbcr/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Drops file in Windows directory

Blocklisted process makes network request

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://www.asianexportglass.shop/p/25.html

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ccc8d5aa5d1a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ccc8d5aa5d1a682c20b0806948bf06d1b5d11961887df70c8902d2146c6d1481

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments