Office (OLE) malware analysis — malicious · 353940f0e62a07ee

MALICIOUS

Office (OLE)

33.5 KB Created: 2006-01-03 07:12:00

MD5: af3297de3103bbdbd8ba43a21620c392 SHA-1: 85e17e7d287be4741f12af83523119104f0978ae SHA-256: 353940f0e62a07ee0488e49ce3b0bf2de1e8fa0245fbabcb77384deaf9aae369

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file is an Office document containing VBA macros, specifically a Document_Open macro. ClamAV detections indicate it is a Trojan. The presence of a Document_Open macro strongly suggests it is designed to execute malicious code upon opening, likely to download and execute a secondary payload. The document body itself appears to be legitimate administrative text, indicating the malicious content is hidden within the macros.

Heuristics 4

ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Pivis-2
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `9ad9bdf891457fb1def9afe8e0bdcb9cb42df87b4ccc5cc2712b3dc5cef30c4c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7858 bytes
Detection ClamAV: Doc.Trojan.Ethan-3 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.