Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 47c87110c208c074…

MALICIOUS

Office (OLE)

105.0 KB Created: 2008-08-21 13:56:00 Authoring application: Microsoft Word 10.1
MD5: 512eaee1a1b974e3a3d48f50677c0fc4 SHA-1: 5039a25cfc0afd9fc7525daa9850260905cf8cc5 SHA-256: 47c87110c208c07425700a025cf712f0a49b003ecee5dd06e5b5fcf017426854
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell

The sample is a Microsoft Word document containing VBA macros. The 'OLE_VBA_SHELL' heuristic indicates that the macro attempts to execute commands via the Shell() function. The 'macros.bas' file extracted from the document is flagged as suspicious by ClamAV. The document body appears to be educational material, likely a lure to trick the user into enabling macros.

Heuristics 5

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-31
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
f9f7ba0338935b34ace4ad00085f7967946e1b0c15f67db6576d3c341063a08b		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 6579 bytes
Detection
ClamAV: Doc.Trojan.Marker-3
Obfuscation or payload: likely
Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.