Office (OLE) / .DOC malware analysis — malicious · 64a4a4f5927d64d8

MALICIOUS

Office (OLE) / .DOC

66.0 KB Created: 2010-08-10 09:06:00 Authoring application: Microsoft Word 10.0

MD5: e77e3f4bb2d83cd65bb3ec141998d117 SHA-1: 2f6ee7d43ca10e49753958e4024da36fd497cceb SHA-256: 64a4a4f5927d64d8c1ed3a63ad43e7cf2e65cfd265c74e12f8db7ea24a84b9aa

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Word document containing VBA macros. The document body presents a license agreement for a 'WWF Font' as a lure. The VBA macro code appears to be designed to copy itself to the Normal template and potentially modify document properties, which is a common technique for establishing persistence or facilitating further malicious activity. The ClamAV detection 'Doc.Trojan.Ethan-1' further supports its malicious nature.

Heuristics 3

ClamAV: Doc.Trojan.Ethan-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Ethan-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `96f65c25163fe74a4e1a757154cf7ac5ea85f68781b57ae5a21d734589382608`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1667 bytes
Detection ClamAV: Doc.Trojan.Ethan-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.