Office (OLE) malware analysis — malicious · 7a7426e08f99b387

MALICIOUS

Office (OLE)

50.5 KB Created: 1999-05-08 04:45:00 Authoring application: Microsoft Word 8.0

MD5: a02379070afb62b3d475ada51f0ca50e SHA-1: 0186c2de04275d016937c1e6473464dc1814cf90 SHA-256: 7a7426e08f99b3877c039824c9ba999718edfc926aa7cacc909d85ff554dcc2b

220 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample contains VBA macros, including AutoOpen and Auto_Close, which are commonly used to execute malicious code upon opening or closing a document. The VBA script attempts to disable macro security by modifying the registry key HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings, indicating an intent to download and execute further payloads. The ClamAV detections further confirm its malicious nature.

Heuristics 5

ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-37
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f959b69de37eedae913ca84055f5313d19d6d5807ac1dab591e1238eeca78290`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	18907 bytes
Detection ClamAV: Doc.Trojan.Class-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.