Office (OLE) malware analysis — malicious · 059cea447d296cf8

MALICIOUS

Office (OLE)

72.0 KB Created: 1999-10-15 19:39:00 Authoring application: Microsoft Word 9.0

MD5: 75a4c6cf61432a62b042d57fdc8fc47f SHA-1: 66f2abc3278f9481b8cde051f7b466478a9f6492 SHA-256: 059cea447d296cf8f92ca4a8600328f7f8b0b265041a6b0a2357f3996ad1ad3d

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV and contains VBA macros. The macro code attempts to disable macro security warnings and save its own code to 'c:\sys00.bak', suggesting an attempt to establish persistence or prepare for further execution. The document body content appears to be unrelated academic material, likely a lure.

Heuristics 3

ClamAV: Doc.Trojan.Ethan-13 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Ethan-13
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `480d5a629d88adfade1e83b41c593e97f00a18766bb0615f79748241c4727afe`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7765 bytes
Detection ClamAV: Doc.Trojan.Ethan-13 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.