Office (OLE) malware analysis — malicious · 109a61bc96b9953c

MALICIOUS

Office (OLE)

51.5 KB Created: 2000-10-25 19:36:37 Authoring application: Microsoft Excel

MD5: 8a6a3051ef4ff9f0a20eb8b0ee77a206 SHA-1: 4a39ad13c26ad60ce606f15bb7944f2341b081a1 SHA-256: 109a61bc96b9953c759a31764f88c865400f8b506b3b37119c44880eae6e91e7

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing a VBA macro with an Auto_Open subroutine, which is a common technique for executing malicious code when the document is opened. The heuristic firings and ClamAV detection strongly indicate malicious intent, likely for delivering a payload. The macro itself appears to be obfuscated and truncated, preventing a detailed analysis of its specific actions beyond initiating execution.

Heuristics 3

ClamAV: Doc.Trojan.Incendi-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Incendi-1
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `8277eb9050a1dbe5798a9b9d8c66eeae603972c9d5792c9ccef7ef850199affc`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	5493 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.