Office (OLE) / .DOC malware analysis — malicious · 5e60dfac6eea937a

MALICIOUS

Office (OLE) / .DOC

27.5 KB Created: 1999-10-29 10:46:00 Authoring application: Microsoft Word 8.0

MD5: 8c38327982c66add0d49a8b0ea90e3cc SHA-1: b5b9161de055b0a687da0eeb9c57451a16700b18 SHA-256: 5e60dfac6eea937ad1e175b8dcb33efc32ac68b04b1a2b546802fdc477c9d4c9

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample contains VBA macros that are designed to write their own code to a file named 'ethan.___' in the root directory. This file is then likely executed, as indicated by the critical ClamAV heuristic firing for 'Doc.Trojan.Ethan-1'. The macro also attempts to disable virus protection and save the document, potentially to maintain persistence or evade detection.

Heuristics 2

ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `a8de515b8a6b7c07720e00d8a15519664d843970971bd66bd46032bffa46a2bc`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1701 bytes
Detection ClamAV: Doc.Trojan.Ethan-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.