Office (OLE) / .ORI malware analysis — malicious · 44274831d8f6819e

MALICIOUS

Office (OLE) / .ORI

15.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel

MD5: 1b0c6990ae2cf42bbe6ba954a94e2f24 SHA-1: 2663912e722a6a48cdb61045c60b031a2cc1480f SHA-256: 44274831d8f6819eaddf388e57d89b286649dbf4133612465aaec2197f8c4024

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Macro.Laroux-5893719-0. Static analysis detected VBA macros, specifically an Auto_Open macro, which is a common technique for executing malicious code when the document is opened. The presence of the Auto_Open macro strongly suggests the intent is to immediately run the embedded malicious payload.

Heuristics 3

ClamAV: Doc.Macro.Laroux-5893719-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Macro.Laroux-5893719-0
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0b768312816d34c72addae36ad07c7c877d50ae70941231345a93924e796543b`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1261 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.