Office (OLE) malware analysis — malicious · 7e36b3e06fea9934

MALICIOUS

Office (OLE)

37.5 KB Created: 1999-11-09 08:26:52 Authoring application: Microsoft Excel

MD5: d93e509da8ac032984955827b9ef1ed8 SHA-1: 293818bd481349073911f700086fef844be41594 SHA-256: 7e36b3e06fea993441bb41ccca6af7042f202630a1af09212eb0759a95160862

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1140 Deobfuscate or Obfuscate Malicious Code T1204.002 Malicious File

The file is identified as malicious by ClamAV with multiple signatures, including 'Win.Trojan.Tristate-2'. It contains VBA macros that utilize CreateObject and GetObject, indicative of malicious activity. The macros appear to be designed to deobfuscate and execute a second-stage payload, likely by manipulating Excel application settings and potentially downloading additional malicious content.

Heuristics 5

ClamAV: Win.Trojan.Tristate-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Tristate-2
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `adca8984bc4d9a54eab2dbb9d3cfdefcb3a27175d973fa41102bc02f56386542`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	9805 bytes
Detection ClamAV: Doc.Trojan.Tristate-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.