Office (OLE) malware analysis — malicious · 43b8de340a77a59f

MALICIOUS

Office (OLE)

121.0 KB Created: 1999-12-06 14:19:00 Authoring application: Microsoft Word 8.0

MD5: f4d60f62e3bf29060ea5b19b10ada0b2 SHA-1: c28eab81ca4f1350bb8108dbced7e04814dcfeac SHA-256: 43b8de340a77a59f9c272165d6fc114af140e66df7f55906ef707d3da4712651

260 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.005 Visual Basic

The file contains a malicious OLE object exploiting the Equation Editor vulnerability, a common delivery mechanism for malware. The presence of AutoOpen and AutoClose VBA macros indicates the document is designed to execute code upon opening and closing. ClamAV detections further confirm its malicious nature, identifying it as Doc.Trojan.VMPCK1-16 and an extracted artifact as Doc.Trojan.Ozwer-1. The document body's content is largely garbled but contains references to statistical testing, likely a lure.

Heuristics 6

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
ClamAV: Doc.Trojan.VMPCK1-16 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.VMPCK1-16
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f642be94b48e0b9d99c467e6e6932d8719dbe93f2e1bbb6da40defe130dbaf61`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	29055 bytes
Detection ClamAV: Doc.Trojan.Ozwer-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.