Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 3ab8f56286e915dc…

MALICIOUS

Office (OLE) / .DOC

40.0 KB Created: 2002-05-02 16:05:00 Authoring application: Microsoft Word 9.0
MD5: b7f7ed86d457fec2493db21e8886b981 SHA-1: 5f1c2e11b84ac3df1e06f9dc290c3706735b8065 SHA-256: 3ab8f56286e915dcf5656d8ecba063be06bc9dcbf23139f67a5bac0a413494fc
308 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

This DOC file contains a VBA macro with an AutoOpen subroutine, which is a common technique for malware execution upon opening. The script attempts to disable macro security settings using 'System.PrivateProfileString' to write to registry keys, specifically targeting 'HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Security' and 'HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security'. It also attempts to spread itself to the Normal template by exporting and importing the 'AutoSpread' module, indicating a self-propagation mechanism. The presence of ClamAV detections for Win.Trojan.Kallisti-1 and Win.Trojan.C-286 further supports its malicious nature.

Heuristics 8

  • ClamAV: Win.Trojan.Kallisti-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Kallisti-1
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
66e20c1c656b76d885f41ae294b7a8f94ccacadf0918c82a9031af04fae66155		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 3657 bytes
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.