Office (OLE) / .DOC malware analysis — malicious · 8abe053b19bfb289

MALICIOUS

Office (OLE) / .DOC

37.0 KB Created: 1999-05-27 13:23:00 Authoring application: Microsoft Word 8.0

MD5: 90b0981ff96edafc9055faf74ef3c7cd SHA-1: d57df6ba701849f084307e3e9bd42433a427a88a SHA-256: 8abe053b19bfb289df3027c12721adf020847d60cea5918abde2734fcf732355

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a Microsoft Word document containing VBA macros, specifically triggering AutoOpen and Auto_Close events. Heuristics indicate the presence of malicious VBA code, and ClamAV detections confirm it as malware. The macros are likely designed to download and execute a secondary payload, as suggested by the ClamAV detections on extracted artifacts.

Heuristics 5

ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-37
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `2e9cd5d70d02e85d614642b675060905ffddadba0079c9e1d77708d458e5896a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	19741 bytes
Detection ClamAV: Doc.Trojan.Class-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.