Office (OLE) / .DOC malware analysis — malicious · 5e4f5e337b15c4cc

MALICIOUS

Office (OLE) / .DOC

47.0 KB Created: 2010-02-11 18:11:00 Authoring application: Microsoft Word 11.2

MD5: 8edde541ea0b7310ae56166dbc80a90c SHA-1: 7a3f89a61f04a77b7e09792276f14a108fcf2053 SHA-256: 5e4f5e337b15c4cca20e468dee35f9d75b01066b6e5a73a78217ddc9e6481413

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a malicious Office document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. The macro logic appears to check for specific dates and potentially modifies the Normal.dot template, which could be used for persistence or further malicious actions. The presence of ClamAV detections further supports its malicious nature.

Heuristics 4

ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Marker-40
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `dba0af6621d5e6a26d88e37f50fd56717904dcf9b6aaca72594b1ed7d164c5d8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4234 bytes
Detection ClamAV: Doc.Trojan.Marker-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.