Office (OLE) / .DOCX malware analysis — malicious · 2a62173d0404ac94

MALICIOUS

Office (OLE) / .DOCX

29.5 KB Created: 2001-04-28 00:12:00 Authoring application: Microsoft Word 9.0

MD5: a10379865047f3af72cd34d4ae5bec2a SHA-1: 19427175afeb2f003cb81bcdd33ebab202a2125d SHA-256: 2a62173d0404ac9468440e2458fe084a625e8f7f4f45a88ffe4f3266a8a2e0a0

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1505.003 Server Software Component: Web Shell

The file is a Microsoft Word document containing VBA macros, specifically triggering on Document_Open. The macro code appears to be designed to overwrite existing macros with its own content, suggesting a mechanism for payload delivery or persistence. The heuristic firings and the presence of VBA macros strongly indicate malicious intent, likely to download and execute a secondary payload. The specific family is not identifiable from the provided evidence.

Heuristics 4

ClamAV: Doc.Trojan.Alive-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Alive-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7603d4eb35f29d9889c589293d286f9d26e48b99d1f9446178eacb73cf70b88c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1690 bytes
Detection ClamAV: Doc.Trojan.Alive-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.