Office (OLE) / .DOT malware analysis — malicious · 366d66010b4a4900

MALICIOUS

Office (OLE) / .DOT

986.5 KB Created: 2007-02-12 10:02:00 Authoring application: Microsoft Word 9.0

MD5: e1e659d371fd92f5e2c9711eb6238c2e SHA-1: c62fff962a797f256d404fc2612a26537d88c52e SHA-256: 366d66010b4a490011cf20284111f5e81803b69c7e4d210a1d29d55638fa7650

168 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The sample is an Office document containing a large VBA macro, flagged as malicious. The presence of an AutoOpen macro and a Shell() call indicates that the macro is designed to execute automatically and run external commands. The heuristic 'Suspicious extracted artifact' further suggests VBA string obfuscation and auto-execution, pointing towards a downloader or initial access mechanism. No specific family could be identified, but the techniques used are common for initial compromise.

Heuristics 5

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `530a1b350012b3d7a92c918ffeea0d1ede307c2e654d13660e8b01685e52c0f3`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	534444 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 165 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.