Office (OLE) / .DOC malware analysis — malicious · 28cb5ca584087435

MALICIOUS

Office (OLE) / .DOC

19.5 KB Created: 2023-03-31 04:44:00 Authoring application: Microsoft Office Word4Normal.dotm@

MD5: 15bfe712d6b979b175d552dab2168b95 SHA-1: 63a2f8b1945743daa2d9384554b75fc9fca3adb1 SHA-256: 28cb5ca58408743501f52d5b3812831d2b9a92557f7110b07fdc728621d8ad86

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1059.001 PowerShell T1204.002 Malicious File

The sample is a malicious DOC file containing VBA macros, specifically a Document_Open macro designed to execute automatically. High-confidence heuristics indicate the presence of suspicious extracted artifacts, including a long encoded blob and VBA auto-execution. The Document_Open macro likely attempts to download and execute a secondary payload, as suggested by the CreateObject call and the presence of the 'macros.bas' embedded artifact.

Heuristics 4

Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7b73ebcd5e2e27ac8641e9909e988c99b25546122024731a87168c88d0514975`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	10257 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 7 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.