Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1527a2e280ad3a64…

MALICIOUS

Office (OLE)

8.5 KB First seen: 2012-06-14
MD5: 7f40ab4d13bdfd12c215f72bd1c5d49e SHA-1: 42ce1d29dadeb3f16f0cfaba6787e5993866520d SHA-256: 1527a2e280ad3a64d17ba71854a611588ad34ce1ee2646689e9b8395020ea4c7
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, specifically identified by 'RSN MACRO VIRUS' markers and embedded text referencing 'Goat file' and 'WordBasic macro-virus'. The presence of AutoOpen and AutoClose functions, common in older macro malware, suggests an intent to execute code upon document opening or closing. While no specific malicious payload is evident, the structure and embedded text strongly indicate a self-replicating or potentially harmful macro.

Heuristics 2

  • ClamAV: Win.Trojan.Gnomo-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Gnomo-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Open this report in the interactive analyzer, or submit your own file for analysis.