Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 67cb0d46e0a36a01…

MALICIOUS

Office (OLE)

725.0 KB Created: 1999-04-30 02:26:00 Authoring application: Microsoft Word 8.0
MD5: 5f291be54e9358bce860d1467aad016f SHA-1: 4262a35232989bb5bbde36769ec7387713e69a99 SHA-256: 67cb0d46e0a36a0125a80eb0ab26b8e9b01038991012f92c3a4412b7a8f3bd92
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1105 Ingress Tool Transfer

The sample contains VBA macros that execute automatically upon opening, as indicated by the 'AutoOpen' and 'Shell()' call heuristics. The script attempts to download a second-stage payload to 'c:\netldx.vxd' from the IP address '209.201.88.110' using hardcoded FTP-like commands. This behavior is consistent with a downloader malware.

Heuristics 6

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-31
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
6ee191968e6db9938251ad5e5f78150e7e085dc636f23c79e5166c7258b3295c		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 18092 bytes
Detection
ClamAV: Doc.Trojan.Marker-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.