Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 69df929069088ea0…

MALICIOUS

Office (OLE)

82.0 KB Created: 2002-02-05 10:57:00 Authoring application: Microsoft Word 10.0
MD5: be1b431a172c867a6dd1c1cadc19665f SHA-1: 5f91ac6b61561714c47e212ce461645cd1763f25 SHA-256: 69df929069088ea0d3170071eefdaca48c9ce962beec2f5640172947ffc732f3
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample contains a critical OLE_VBA_SHELL heuristic firing, indicating the presence of a Shell() call within its VBA macros. The Document_Open macro is present and configured to execute, further suggesting an automated malicious action upon opening. This combination strongly implies the document is designed to execute arbitrary commands, likely to download and run a secondary payload, aligning with common malware delivery techniques.

Heuristics 6

  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-31
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
03a58c4e6b0b6136dbf44e5110bc1d5c0b54542844c53fb87e3304c53089be58		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 29740 bytes
Detection
ClamAV: Doc.Trojan.Eight941-1
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.