Office (OLE) malware analysis — malicious · 722e0e350f3af414

MALICIOUS

Office (OLE)

46.0 KB Created: 2007-01-31 14:24:00 Authoring application: Microsoft Word 11.3.8

MD5: 114615987b6ab330429a515cd1b23233 SHA-1: f6438f9157c88c6427c854a0e46aea9d0aa5e3e7 SHA-256: 722e0e350f3af414a36346ccb220316efa46807ecba5e812a0dea99b9f7d66de

182 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file contains VBA macros, including a Document_Open macro, which is a strong indicator of malicious intent. The embedded URL and ClamAV detections further support its classification as malicious. The macro code appears to be designed to execute upon opening the document, likely to download and execute a secondary payload, though the specific actions are obfuscated.

Heuristics 5

ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Marker-40
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.valleaniene.it/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ffa7ace8e5d1a54562d64e4b5b5196404b370ba409d38af740ca5494b17032ab`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4223 bytes
Detection ClamAV: Doc.Trojan.Marker-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.