Malware Insights
The critical ClamAV detections (Doc.Trojan.Concept-28 and Doc.Trojan.Allen-4) strongly indicate a malicious document. The presence of an AutoOpen VBA macro, identified by the OLE_VBA_AUTOOPEN heuristic, is a common technique for executing malicious code upon document opening. The AutoOpen macro in the 'macros.bas' script attempts to copy itself and other macros to global template locations such as 'Global:Autoexec', 'Global:RpAE', and 'Global:FileSave', which is a clear indicator of establishing persistence. The script's intent is to install protection macros and disinfect the Normal template, but the underlying mechanism is designed for malicious macro execution and persistence.
Heuristics 4
-
ClamAV: Doc.Trojan.Concept-28 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Concept-28
-
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAVClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas5531f4bf13eaa339d2defba473e1acd14fb994f06bec67a036318e1968a24ada |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 19739 bytes |
|
Detection
ClamAV:
Doc.Trojan.Allen-4
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.