Office (OLE) malware analysis — malicious · 8b28064b1f55c735

MALICIOUS

Office (OLE)

295.5 KB Created: 1999-12-01 21:56:00 Authoring application: Microsoft Word 8.0

MD5: bc49a0f7893d443ef5a2d7d687cca8aa SHA-1: 289fc086f60d3c320077eae19fc3f503e6423e37 SHA-256: 8b28064b1f55c7356e9a86902eb23e2819f909f42205b56eecf8bfe0921f7c4c

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file contains VBA macros, including AutoOpen and Auto_Close, and a high-severity heuristic firing for the Equation Editor OLE object. ClamAV detections indicate it is a malicious document, likely a Trojan. The presence of the Equation Editor object strongly suggests an attempt to exploit a known vulnerability to download and execute a secondary payload.

Heuristics 6

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
ClamAV: Doc.Trojan.VMPCK1-16 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.VMPCK1-16
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ea6e305a52039f7ba1650941f511db7be6ab447f55a82eee6d0bf012f167257c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	29054 bytes
Detection ClamAV: Doc.Trojan.Ozwer-1 Obfuscation or payload: unlikely
`ole10native_00.bin` `dcad1adabf458c2f364c9e9607f77418cf4cbab376c2edd49b5f525557623bed`	ole-package	OLE Ole10Native stream: ObjectPool/_1005582711/Ole10Native	170084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.