MALICIOUS
88
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1059.001 PowerShell
The OLE document contains VBA macros that are triggered by the AutoOpen event. The heuristic 'OLE_VBA_PCODE_AUTOEXEC_EXEC' indicates that the macro attempts to execute code using the Shell function. The embedded script mentions 'Abuses FTP as a payload' and includes a specific FTP URL, suggesting it downloads and executes a secondary payload. The file name 'groovie.doc' and the mention of 'VicodinES' in the document body suggest a potential lure, though the exact nature is unclear without further context. The large slack space in the OLE structure is also noted as anomalous.
Heuristics 3
-
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALYOLE file is 47,616 bytes but its declared streams total only 26,473 bytes — 21,143 bytes (44%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
VBA project contains no executable statements low OLE_VBA_MACROSDocument contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas75702493909463bf8093aec8b508fcc96c561fa55dfe899fecd271624a111a7a |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 248 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.