Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 0a23e1acc216380e…

MALICIOUS

Office (OLE) / .DOC

114.0 KB Created: 2010-06-30 10:53:00 Authoring application: Microsoft Word 10.0
MD5: cb39a59614c06110942ee63427d5743c SHA-1: a7d06388eb7e3b6b4bee9ec6299ec91ae53eb3cd SHA-256: 0a23e1acc216380ef9e1decdaf4b2ecae16fdafbc7ef6ba56d7087c85b6f7593
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a malicious Office document containing VBA macros, specifically a Document_Open macro. The macro attempts to modify the Normal.dot template and displays conditional messages to the user, potentially as a diversion or to check for specific conditions before executing further malicious actions. The ClamAV detection further confirms its malicious nature. No network indicators or further payload delivery mechanisms were identified within the provided evidence.

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-2
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.apple.com/DTDs/PropertyList-1.0.dtd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
7fa10c279562b3fcf7a526499bce0a023766172572ece03085e93c7a1da5e9cc
vba-macro oletools.olevba.extract_macros (decoded VBA source) 4263 bytes
Detection
ClamAV: Doc.Trojan.Marker-2
Obfuscation or payload: unlikely