Office (OLE) / .EXE malware analysis — malicious · 440a3bc088fd48a2

MALICIOUS

Office (OLE) / .EXE

42.0 KB Created: 1997-04-26 16:26:00 Authoring application: Microsoft Word 8.0

MD5: 57fe835fbfac293f4c6c9b24bfe0cdcb SHA-1: 645d3d1391d3528454c7c5c5b3b1d3feb424a061 SHA-256: 440a3bc088fd48a2c75cefb900757a4718c941c854147bed0a7971d5ba4e69bf

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample is an OLE file containing VBA macros, specifically triggering on Document_Open and Auto_Close events. ClamAV detections indicate it is a known malicious document trojan. The presence of VBA macros suggests an initial execution vector, likely to download and run a secondary payload, though no specific URLs or further execution details were extracted from this static analysis.

Heuristics 5

ClamAV: Doc.Trojan.Eight941-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Eight941-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `75e0f2991fe4c5316ce7855481961c71e51ae80f825f78ad6b59af6a3eb4d8f0`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	12299 bytes
Detection ClamAV: Doc.Trojan.Eight941-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.