Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2cdf2c4164975098…

MALICIOUS

Office (OLE)

51.0 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 43ab777738fa0b738718b74bd7f139be SHA-1: 731c3fd28fb5f3d5dd8e81e62b62c45cccdf61d4 SHA-256: 2cdf2c41649750988a11175e4490d7216c7e03da40ef67cfc5dbc83b4ed4dd25
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is detected as malicious by ClamAV with the signature Doc.Trojan.Marker-17. Static analysis revealed the presence of VBA macros within the document. These macros are highly suspicious and likely serve as a loader for additional malicious content, such as a second-stage payload.

Heuristics 2

  • ClamAV: Doc.Trojan.Marker-17 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-17
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 38734 bytes
SHA-256: f0db1762e2a1b8815d8350d2489ff387183e5cb3eb81acff49ffba26f48cef79
Detection
ClamAV: Doc.Trojan.Marker-17
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
' Ditry PC
' DP
'
' 1/5/2000 4:09:31 PM
'
' Ditry PC
' DP
'
' 1/5/2000 4:09:13 PM
'
' ICD
' I
'
' 16/11/1999 10:51:00 AM
'
' ICD
' I
'
' 15/11/1999 09:46:41 AM
'
' ICD
' I
'
' 14/11/1999 04:40:38 PM
'
' ICD
' I
'
' 13/11/1999 07:37:27 PM
'
' ICD
' I
'
' 13/11/1999 10:43:45 AM
'
' ICD
' I
'
' 12/11/1999 05:11:57 PM
'
' ICD
' I
'
' 12/11/1999 03:20:56 PM
'
' ICD
' I
'
' 12/11/1999 03:20:06 PM
'
' ICD
' I
'
' 12/11/1999 03:16:31 PM
'
' ICD
' I
'
' 12/11/1999 03:08:22 PM
'
' ICD
' I
'
' 12/11/1999 03:07:37 PM
'
' ICD
' I
'
' 12/11/1999 11:55:46 AM
'
' ICD
' I
'
' 12/11/1999 07:27:16 AM
'
' ICD
' I
'
' 11/11/1999 05:21:41 PM
'
' ICD
' I
'
' 11/11/1999 04:50:14 PM
'
' ICD
' I
'
' 11/11/1999 03:17:50 PM
'
' ICD
' I
'
' 11/11/1999 02:00:06 PM
'
' ICD
' I
'
' 11/11/1999 12:07:03 PM
'
' Jose Luis Restrepo
' JLR
'
' 10/11/1999 04:38:20 PM
'
' Jose Luis Restrepo
' JLR
'
' 10/11/1999 03:07:39 PM
'
' ECOPETROL
' E
'
' 11/10/1999 02:36:26 PM
'
' Muriel Cecilia Berbesí
' MCB
'
' 29/10/1999 03:46:50 PM
'
' Muriel Berbesi
' MCB
'
' 28/10/1999 08:52:59 AM
'
' Muriel Berbesi
' MCB
'
' 28/10/1999 08:48:08 AM
'
' GAS NATURAL
' GN
'
' 26/10/1999 06:29:42 PM
'
' proyecto sap natural
' sapn
'
' 26/10/1999 06:26:28 PM
'
' proyecto sap natural
' sapn
'
' 22/10/1999 08:21:08 PM
'
' proyecto sap natural
' sapn
'
' 22/10/1999 07:15:24 PM
'
' proyecto sap natural
' sapn
'
' 22/10/1999 07:14:58 PM
'
' proyecto sap natural
' sapn
'
' 22/10/1999 09:21:49 AM
'
' proyecto sap natural
' sapn
'
' 20/10/1999 06:23:18 PM
'
' proyecto sap natural
' sapn
'
' 20/10/1999 06:21:02 PM
'
' proyecto sap natural
' sapn
'
' 20/10/1999 06:19:41 PM
'
' proyecto sap natural
' sapn
'
' 19/10/1999 07:32:46 PM
'
' proyecto sap natural
' sapn
'
' 15/10/1999 10:52:35 PM
'
' proyecto sap natural
' sapn
'
' 15/10/1999 12:06:06 PM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 09:01:56 PM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 10:40:08 AM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 08:38:33 AM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 08:36:56 AM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 08:36:24 AM
'
' proyecto sap natural
' sapn
'
' 14/10/1999 08:34:10 AM
'
' proyecto sap natural
' sapn
'
' 12/10/1999 10:36:29 AM
'
' proyecto sap natural
' sapn
'
' 11/10/1999 08:25:45 AM
'
' proyecto sap natural
' sapn
'
' 9/10/1999 05:20:17 PM
'
' proyecto sap natural
' sapn
'
' 8/10/1999 08:54:44 PM
'
' proyecto sap natural
' sapn
'
' 8/10/1999 11:45:04 AM
'
' proyecto sap natural
' sapn
'
' 8/10/1999 10:25:17 AM
'
' Gas Natural S.A.,E.S.P.
' GNS
'
' 8/10/1999 08:46:04 AM
'
' Gas Natural S.A.,E.S.P.
' GNS
'
' 29/09/1999 08:27:32 PM
'
' Gas Natural S.A.,E.S.P.
' GNS
'
' 27/09/1999 02:55:04 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 24/09/1999 05:48:12 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 24/09/1999 12:33:23 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 24/09/1999 08:26:26 AM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 21/09/1999 03:00:13 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 17/09/1999 02:23:31 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 17/09/1999 08:44:12 AM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 16/09/1999 04:21:15 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 15/09/1999 05:07:11 PM
'
' GAS NATURAL S.A. ESP
' GNSE
'
' 15/09/1999 01:18:40 PM
'
' Gas Natural E.S.P.
' GNE
'
' 15/09/1999 11:54:09 AM
'
' Gas Natural E.S.P.
' GNE
'
' 15/09/1999 08:56:53 AM
'
' Gas Natural E.S.P.
' GNE
'
' 15/09/1999 07:49:03 AM
'
' Gas Natural E.S.P.
' GNE
'
' 14/09/1999 07:32:49 PM
'
' Gas Natural E.S.P.
' GNE
'
' 14/09/1999 09:06:58 AM
'
' Gas Natural
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.