Doc.Trojan.Xaler-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 03f84c576aa87510…

MALICIOUS

Office (OLE)

49.0 KB Created: 2005-04-08 03:27:00 Authoring application: Microsoft Word 9.0
MD5: 04774125f6161a45612e6dec0c59119d SHA-1: 8c96fcb34f42d21dca895cc56947f417023ce987 SHA-256: 03f84c576aa87510e8c0d37e2486b40c94f3a3db001d269d4679cbcb242a4266
180 Risk Score

Malware Insights

Doc.Trojan.Xaler-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains embedded VBA macros, specifically a Document_Open macro, which is a strong indicator of malicious intent. The macro attempts to export its own code to a temporary file, read it back, and then re-insert it into the Normal template or the active document, potentially for persistence or obfuscation. The ClamAV detection of 'Doc.Trojan.Xaler-1' further confirms its malicious nature. The macro's actions suggest it aims to modify the document's behavior or download additional payloads.

Heuristics 4

  • ClamAV: Doc.Trojan.Xaler-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Xaler-1
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
6c26892929e07fa1f12654e26406ba02440ed0e1ade5454510e536efd19bc353		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1959 bytes
Detection
ClamAV: Doc.Trojan.Xaler-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.