Office (OLE) / .DOC malware analysis — malicious · 90992e9f77b115b7

MALICIOUS

Office (OLE) / .DOC

385.5 KB Created: 2010-08-07 10:00:00 Authoring application: Microsoft Office Word

MD5: e0b3c23880722fb10a8ffe3b5505d1df SHA-1: 00b2658fde3064fb2960b1b3803d3ec0da8edc11 SHA-256: 90992e9f77b115b761877245ecd3e2ea8e7f1ea7ab33159096b52e82d46453a7

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.003 Windows Command Shell T1059.001 PowerShell

The sample contains VBA macros, indicated by the OLE_VBA_MACROS heuristic. A high-severity heuristic, SE_CLIPBOARD_COMMAND_LURE, flags that the document explicitly instructs the user to copy and paste content into a command-line execution context. This is further supported by the OLE_VBA_GETOBJ heuristic, suggesting the use of GetObject to potentially execute commands. No specific malware family could be identified, but the overall pattern suggests a downloader or initial execution stage.

Heuristics 5

GetObject call high OLE_VBA_GETOBJ

GetObject call
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `f2dba5d37c8d7f31f42cec43fd2bbb5f61dc2b08f8cda6083a219317f4cf5c48`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	30768 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 26 Chr/ChrW string-construction calls.

Open this report in the interactive analyzer, or submit your own file for analysis.