Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 04e4cdabbce559b2…

MALICIOUS

Office (OLE) / .DOC

14.5 KB Created: 1986-05-09 15:39:00 Authoring application: Microsoft Word 6.0
MD5: 25030aec4a07885d366eb15a335ba48d SHA-1: 88e977e47387863f835c89fe5d89fd83bb1a6225 SHA-256: 04e4cdabbce559b2338eaee8d0b47e26514289100ea65b2df87aebf02fabc596
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a Microsoft Word document with a critical heuristic firing indicating it is a Win.Trojan.Macro-11. The presence of AUTOOPEN and macro-related strings suggests the document is designed to execute malicious VBA code upon opening. This macro likely attempts to download and execute a secondary payload, a common tactic for macro-based malware.

Heuristics 1

  • ClamAV: Win.Trojan.Macro-11 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Macro-11