Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 01621d673cb539d4…

MALICIOUS

Office (OLE)

205.0 KB Created: 2004-03-23 16:23:00 Authoring application: Microsoft Word 11.3
MD5: be9857bd3b42e76483a8b0b202782eef SHA-1: 8b9399656b48453ff6299fb8c28b51c11af1caae SHA-256: 01621d673cb539d44fd4ad09cb5c7bf2b6fec7f432a51221515e50521824e296
188 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1505.003 Server Software Component: Malicious File

The sample contains VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon opening a document. The heuristic 'SE_INVOICE_LURE' suggests a social engineering pretext. The VBA code attempts to disable virus protection and appears to be designed to delete files, as indicated by the ClamAV detection name 'Doc.Trojan.Thus-10' and comments within the script.

Heuristics 5

  • ClamAV: Doc.Trojan.Thus-10 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Thus-10
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
37b3ef071209d7670e29b8794d6bf501556ea67160d052d0183cfe162e29b86a		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2279 bytes
Detection
ClamAV: Doc.Trojan.Thus-10
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.