MALICIOUS
160
Risk Score
Malware Insights
The file is identified as a malicious Office document by ClamAV, specifically as 'Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0'. It is password-encrypted and exhibits OLE FAT corruption, indicating a deliberate attempt to obscure its contents. The detection name suggests it functions as a downloader, likely for the Formbook malware family, and the presence of encrypted OOXML points towards VBA macro usage for execution.
Heuristics 4
-
Encrypted Office package with CFB FAT corruption critical OLE_ENCRYPTED_AND_MALFORMEDEncrypted-package shape co-occurs with FAT-chain corruption — the documented combined evasion form.
-
ClamAV: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Downloader.Formbook-bc97c1e0c33c3c93-9951465-0
-
Office document is password-encrypted medium OFFICE_ENCRYPTED_PACKAGEOLE container holds MS-OFFCRYPTO encrypted package (Standard Encryption (Office 2007, AES)).
-
Office OOXML encrypted with default VelvetSweatshop password medium OFFICE_DEFAULT_PASSWORD_ENCRYPTED_OOXMLOLE EncryptedPackage decrypts with Excel's built-in VelvetSweatshop password. Office opens this transparently, and malware uses it to hide OOXML exploit parts from scanners that only inspect the outer OLE container.
Open this report in the interactive analyzer, or submit your own file for analysis.