Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2e140b316f35021b…

MALICIOUS

Office (OLE)

46.5 KB Created: 2008-03-05 15:06:00 Authoring application: Microsoft Word 11.3.8
MD5: 3e01942adf0ca9a3e6712cb6626d4f7b SHA-1: 21ffd44ba17b172dd1a00477dfa356c5b4d2863c SHA-256: 2e140b316f35021b417ddf353f305fe669253135733ee4976250515d37d8873f
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.003 Windows Command Shell

This document contains VBA macros, as indicated by the OLE_VBA_MACROS heuristic. The critical OLE_VBA_SHELL heuristic confirms that these macros attempt to execute arbitrary commands using the Shell() function. The CLAMAV_DETECTION heuristic further classifies this file as malware (Doc.Trojan.Marker-31). The presence of the macros.bas file and the use of Shell() suggest a downloader or dropper functionality, though the specific payload is not discernible from the provided evidence. The embedded URLs were confirmed as benign and do not appear to be directly related to the malicious functionality.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-31
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ugr.es/local/juancalvo
    • http://www.ugr.es/local/pguerrero

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
8f7cd8874642d1cc97503fcc0c55d4b4c9f33e620587afd4b867db735ffaf8c3		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 6150 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.