MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1505.003 Server Software Component: Office Application Startup
The sample is a Microsoft Word document containing VBA macros, including a Document_Open macro, which is a common technique for executing malicious code upon opening. The presence of an XLM macro sheet further indicates malicious intent. The VBA script appears to interact with a companion file (indicated by the ',6' extension) and potentially saves or closes the document, suggesting it's part of a multi-stage attack. The extracted artifact 'macros.bas' is also flagged as suspicious.
Heuristics 5
-
Document_Open macro high OLE_VBA_DOCOPENDocument_Open macro
-
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
-
Environ() call (env variable access) low OLE_VBA_ENVIRONEnviron() call (env variable access)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas577b4858cf1b694733dbeff3efe5ffdd3afc0ab487d1da2ef9bdc4826d85bbab |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 33644 bytes |
|
Detection
ClamAV:
No threats found
Obfuscation or payload:
likely
Carved macro source contains an auto-exec entry point and execution/download terms.
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.