Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 25d7d3f29ac7ef0d…

MALICIOUS

Office (OLE) / .DOC

60.5 KB Created: 2004-08-22 10:19:00 Authoring application: Microsoft Word 8.0
MD5: 1b6ba08d0c3a38f74ec5663ab3463d85 SHA-1: 6911bfeab6f0700893e31d9268ac3bbf24427ad1 SHA-256: 25d7d3f29ac7ef0d035c908bf1e2b1e60e33bf04708ad3c9ae31a44f3e2ad8ea
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1566.001 Spearphishing Attachment

The file is a malicious OLE document containing a Document_Open VBA macro. This macro is likely responsible for executing the malicious payload, as indicated by the ClamAV detection 'Doc.Trojan.Thus-8'. The embedded URL is likely part of the lure or a command and control channel. The document body contains seemingly random Swedish text, which may be used to obfuscate the malicious intent.

Heuristics 5

  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 61,952 bytes but its declared streams total only 22,223 bytes — 39,729 bytes (64%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.spl.org/default.asp?pageID=about_news_detail&cid=1104355071539

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
9742c127b3cfea3ed5dc0971a6f3ea3bc783831e66195bd1e734183ffefdbd22		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2429 bytes
Detection
ClamAV: Doc.Trojan.Thus-8
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.