Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 72f900320421b139…

MALICIOUS

Office (OLE)

259.5 KB Created: 2008-11-19 19:19:00 Authoring application: Microsoft Word 11.3.8
MD5: 42d693c829a4eafdb0a39e5f2b29c36d SHA-1: 918d7a1f88f8b2c2f6fd8375a345b1175923c061 SHA-256: 72f900320421b139c5c1168732140e2db8dc17c854c9172ec818186fcf661459
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and contains VBA macros, including a Document_Open macro, which is a common technique for initial execution. The macro code appears to be designed to download and execute further payloads, as indicated by the heuristic firings and the nature of the VBA code. The presence of the Document_Open macro suggests an attempt to execute malicious code upon opening the document, aligning with the Spearphishing Attachment technique.

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-40
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.apple.com/DTDs/PropertyList-1.0.dtd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d41c9267beb7aeb9002f6cfedc0d926f627e1f4f0feade367b7ea63422dfcbca		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 4225 bytes
Detection
ClamAV: Doc.Trojan.Marker-2
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.