Office (OLE) / .DOCX malware analysis — malicious · 22d95d386a3c2b61

MALICIOUS

Office (OLE) / .DOCX

49.5 KB Created: 1999-01-01 09:59:00 Authoring application: Microsoft Word 8.0

MD5: 748078de82c56a4ab83fc2b9de5e884f SHA-1: 82065eabc6b632f064b5968435b5e9ccae9ed73d SHA-256: 22d95d386a3c2b613b8702e055c0cd4fbc120cdf95178a7ce8ca39ddbcd22283

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. The VBA code appears to be obfuscated but is designed to run automatically when the document is opened. The ClamAV detection of 'Doc.Trojan.Antisocial-4' strongly suggests malicious intent, likely involving the execution of further malicious payloads.

Heuristics 5

ClamAV: Doc.Trojan.Antisocial-4 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Antisocial-4
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 50,688 bytes but its declared streams total only 29,209 bytes — 21,479 bytes (42%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0b11fb4e770ee5213b9d7384949662335d85d8e556637029e0b25b488e229cd3`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	5927 bytes
Detection ClamAV: Doc.Trojan.Antisocial-4 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.