Malicious Office (OLE) / .DOCX — malware analysis report

Static analysis result for SHA-256 226730c5a6da9505…

MALICIOUS

Office (OLE) / .DOCX

40.0 KB Created: 1999-12-07 15:20:00 Authoring application: Microsoft Word 8.0
MD5: a556098ed48d3c3c56189ad2d6372744 SHA-1: 738005aaf95e87930ef1ec2162a9973381913c9b SHA-256: 226730c5a6da950562eb527a4e8036be2e9b0c9e02a037307f6f0cbc653061f1
400 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1564.004 Disable or Modify Registry T1059.001 PowerShell

The sample contains VBA macros, including a Document_Open macro, which is designed to execute automatically. The script attempts to disable macro virus protection by modifying registry keys such as EnableMacroVirusProtection and Options6. It also uses CreateObject and Shell() calls, indicating an intent to download and execute a second-stage payload. The ClamAV detection of 'Doc.Trojan.Snack-2' and 'Win.Trojan.C-286' further supports its malicious nature.

Heuristics 9

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • ClamAV: Doc.Trojan.Snack-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Snack-2
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
b6ba9f992882fce06e3d157c23634b661f33714c63313dc38e8c980ba85f385d		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 16488 bytes
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.