Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 46b20e459a09daaf…

MALICIOUS

Office (OLE)

129.5 KB Created: 2008-08-29 16:05:00 Authoring application: Microsoft Word 11.5.0
MD5: 99cc705eb8c41addf9f579967d9f7c21 SHA-1: be7be5a94932ba58d24dc77ef9aab2305dcc7e14 SHA-256: 46b20e459a09daaf89f3d072b0236912aabe1ae16c7cc94ec98bd6aa2e91b564
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file contains VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon opening a document. The document body presents information about Yellowstone National Park, but it also contains a hyperlink to 'CalendarsThatWork.com Premium Membership', which is flagged as unknown reputation. This suggests a phishing or scam attempt, using the educational content as a lure to drive traffic to a potentially malicious site. No scripts were extracted, limiting deeper analysis of the macro's specific actions.

Heuristics 4

  • ClamAV: Doc.Trojan.Walker-9 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Walker-9
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.solcomhouse.com/yellowstone.htm
    • http://www.shannontech.com/ParkVision/Yellowstone/YwThermal.html
    • http://www.calendarsthatwork.com/membershipd.php
    • http://dsc.discovery.com/convergence/supervolcano/supervolcano.html?jump_to=content
    • http://www.nps.gov/yell/naturescience/geothermal.htm
    • http://www.nationalgeographic.com/yellowstone/
    • http://www.apple.com/DTDs/PropertyList-1.0.dtd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
428feb3ab04fb72042204955968fea95bdb49749084ac14551456d1db5eae533		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 3158 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.