Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 320e53a1be4538af…

MALICIOUS

Office (OLE)

77.0 KB Created: 2006-09-04 03:53:00 Authoring application: Microsoft Office Word
MD5: 6d05a46cf24f99a7d202e749d06c6aca SHA-1: 5079d26f4f00b2f377f08485ce690d6a748ee437 SHA-256: 320e53a1be4538af27c51d541bfc3ba3d23e093eb663c395e4efe0ad3d92308a
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic for Applications T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature 'Doc.Trojan.GDD-1'. Static analysis detected VBA macros, specifically a Document_Open macro, indicating that the document is designed to execute malicious code upon opening. The document body content appears to be a legitimate-looking procurement or bidding document in Russian, likely serving as a lure to trick the user into enabling macros. No specific IOCs like URLs or file paths were extracted from the macros themselves, but the presence of the macro and the ClamAV detection strongly suggest a macro-based malware delivery.

Heuristics 5

  • ClamAV: Doc.Trojan.GDD-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.GDD-1
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d75bbc01d923eedf14ba238d5c9a8c7468c76ed62b9e1ae3380b46458e19ce96		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 12110 bytes
Detection
ClamAV: Doc.Trojan.GDD-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.