Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 17fde80057b63fc4…

MALICIOUS

Office (OLE)

153.0 KB Created: 2001-07-11 16:18:00 Authoring application: Microsoft Word 9.0
MD5: 9fe9cca386301622336919c08f65e9b3 SHA-1: 5f75b64a7410934e277ccec4929ab5878e0383d2 SHA-256: 17fde80057b63fc48ad0a967ab06a965c4c0a621129fe2290bf7c871cd0f5fbb
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains VBA macros, specifically an AutoClose macro named 'Arbind2000', which is designed to copy itself to the Normal template and the active document. This action aims to achieve persistence by ensuring the macro runs whenever Microsoft Word is opened or a document is loaded. The macro attempts to export itself to a temporary file 'c:\arbind2000.tmp' before importing it into the active document, indicating a persistence mechanism.

Heuristics 4

  • ClamAV: Doc.Trojan.Titch-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Titch-3
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
9049f284b7e484370ef98d881a8b18200642ac70786defcacc9dd1472afe2592		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1678 bytes
Detection
ClamAV: Doc.Trojan.Titch-3
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.