Office (OLE) malware analysis — malicious · 4900d403402b3c63

MALICIOUS

Office (OLE)

61.0 KB Created: 2004-03-23 15:57:00 Authoring application: Microsoft Word 11.5.6

MD5: a669cffa54f67a5a1afa01d4c4063766 SHA-1: d238fdd0f97077479d4000a2303298a7b349355a SHA-256: 4900d403402b3c63cce1e46091e66e8c8e3a8730d696747c20cfa1f48cbd2f9f

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 Malicious File

The file is an Office document containing VBA macros, specifically a Document_Open macro, which is a common delivery mechanism for malware. The document body presents a fake academic worksheet to entice the user to open it and potentially enable macros. While no specific payload or network activity was detected in this static analysis, the presence of the Document_Open macro and the ClamAV detections indicate malicious intent, likely to download and execute a secondary payload.

Heuristics 4

ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Marker-40
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `4d840735f64370eed491ae174d4c3cebc63d105512970d4d44c50b8d8ee19f18`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4261 bytes
Detection ClamAV: Doc.Trojan.Marker-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.