Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2cff471b0d1167bc…

MALICIOUS

Office (OLE)

108.0 KB Created: 2007-08-24 15:28:00 Authoring application: Microsoft Word 11.3
MD5: f9ef4ec63a7763a1ff93632e55aa2b37 SHA-1: f430f3e87c5113febfe6838b0b9f4fa8b0b22e56 SHA-256: 2cff471b0d1167bcea99c5ddf5c43735bed22a379ba3c9963e522f36d8e92e4d
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Office document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. ClamAV detections further confirm its malicious nature. The presence of the 'macros.bas' artifact indicates that the VBA code is the primary mechanism for delivering the malicious payload, likely involving the download and execution of a second-stage artifact.

Heuristics 4

  • ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-40
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
271f9e1eaa19883a0c61678fd9a47981de9f5a0d135e3a80aacae1178069c9c7		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 4221 bytes
Detection
ClamAV: Doc.Trojan.Marker-2
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.