Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 26e0e9128ae58158…

MALICIOUS

Office (OLE)

68.5 KB Created: 2010-02-20 03:36:00 Authoring application: Microsoft Macintosh Word
MD5: c94e079fb5ac2711c67a8454da4ab979 SHA-1: d523f1f020ecb78bac0bc1305420877b7402df15 SHA-256: 26e0e9128ae58158d49de843ca6da86ced5ac95cefcb3cc7fc9aae71f496a7e9
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell

The file is identified as malicious by ClamAV with multiple critical heuristic firings, including the presence of VBA macros and the use of the Shell() function. The extracted 'macros.bas' file is a VBA macro that likely executes arbitrary code. The document body content appears to be unrelated educational planning material, suggesting it's a lure.

Heuristics 6

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-31
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
49a11c2a0a498827e6bb0214dd91941cba5d0263798a9a2935132baf5425b8d7		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 6308 bytes
Detection
ClamAV: Doc.Trojan.Marker-3
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.