Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 761f2ea99685cd87…

MALICIOUS

Office (OLE)

22.5 KB Created: 1997-03-20 14:54:00 Authoring application: Microsoft Word for Windows 95 First seen: 2012-06-14
MD5: 7460e592085d859897d8bddd05c0348d SHA-1: 6d08762143230c552c0bdfaf34d8882d880a0ff1 SHA-256: 761f2ea99685cd87c69aaaa2f19b07cca2f81b1338db1c50452e5b2feff8c32f
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV detection and the presence of a legacy WordBasic AUTOOPEN macro indicate malicious intent. The AUTOOPEN macro is a known method for automatically executing malicious code when a document is opened, typically used to download and run further stages of malware. The document body contains obfuscated text and references to legacy WordBasic functions, further supporting this.

Heuristics 2

  • ClamAV: Win.Trojan.Pig-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pig-2
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Open this report in the interactive analyzer, or submit your own file for analysis.