Malicious Office (OLE) — malware analysis report

Heuristics 6

• ClamAV: Doc.Trojan.Metsy-1 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Trojan.Metsy-1
• VBA macros detected medium 3 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
  VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
  Matched line in script

  Options.VirusProtection = False

• Document_Open macro low OLE_VBA_DOCOPEN
  Document_Open macro
  Matched line in script

  Private Sub Document_Open()

• Auto_Close macro low OLE_VBA_AUTOCLOSE
  Auto_Close macro
  Matched line in script

  Sub AutoClose()

• Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
  OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Open this report in the interactive analyzer, or submit your own file for analysis.