Office (OLE) / .DOCX malware analysis — malicious · 2afb2ee13bda499e

MALICIOUS

Office (OLE) / .DOCX

37.0 KB Created: 2005-05-20 06:59:00 Authoring application: Microsoft Word 8.0

MD5: edfc3b90b230efdc6a14d6fefd959842 SHA-1: 2f3080ace4548305be563d3ea15be623333ed85b SHA-256: 2afb2ee13bda499e643bfe778602e8590a46a796c285195e97c91d8ed7514a53

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1505.003 Server Software Component: Web Shell T1059.001 PowerShell

The sample is identified as malicious by ClamAV (Doc.Trojan.Hopper-8). It contains VBA macros that utilize CreateObject and GetObject calls. The script attempts to copy its own code into Excel's startup path as 'Book1.' and modifies registry keys related to Excel startup. This suggests an attempt to establish persistence or download and execute a second-stage payload via Excel.

Heuristics 6

ClamAV: Doc.Trojan.Hopper-8 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Hopper-8
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `3f7e6f2b42c3af7efdf03ea696849a88d966bfd8428e357e50b6f4259a75c0d5`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3366 bytes
Detection ClamAV: Doc.Trojan.Hopper-8 Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.