Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 924f36949989576f…

MALICIOUS

Office (OLE)

46.5 KB Created: 2010-01-12 17:10:00 Authoring application: Microsoft Word 11.5.6
MD5: d2c66b3726bcf890589b5f3bf31124b7 SHA-1: 1759706a2336b12fb3efc3d3bd2cc8a537b9abcb SHA-256: 924f36949989576f4783841db4252ba8229c18c507a49765e66a4d66bbfacd2e
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The document presents itself as a math study guide to trick users into clicking embedded links. The presence of a Document_Open macro and embedded VBA code indicates that the document is designed to execute malicious actions upon opening. The ClamAV detection as 'Doc.Trojan.Thus-8' further supports its malicious nature. The macro likely attempts to download and execute a second-stage payload from one of the embedded URLs.

Heuristics 5

  • ClamAV: Doc.Trojan.Thus-8 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Thus-8
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.clickandclimb.com/content/mathcontent/prealgebra/pa-probability-of-independent-events.php
    • http://www.clickandclimb.com/content/mathcontent/prealgebra/pa-experimental-probability.php
    • http://www.glencoe.com/sec/math/studytools/cgi-bin/msgQuiz.php4?isbn=0-02-833051-X&chapter=13&lesson=1
    • http://www.glencoe.com/sec/math/mac/mac01/course2/pdf/m_21301.pdf
    • http://www.glencoe.com/sec/math/studytools/cgi-bin/msgQuiz.php4?isbn=1-57039-850-X&chapter=10&lesson=1
    • http://www.mrnussbaum.com/probfair.htm
    • http://www.glencoe.com/sec/math/studytools/cgi-bin/msgQuiz.php4?isbn=0-02-833051-X&chapter=13&lesson=2
    • http://www.glencoe.com/sec/math/mac/mac01/course2/pdf/m_21302.pdf
    • http://www.glencoe.com/sec/math/mac/mac01/course2/pdf/m_21303.pdf
    • http://www.studyzone.org/mtestprep/math8/g/probcompoundquiz.cfm
    • http://www.mathgoodies.com/lessons/vol6/independent_events.html
    • http://www.onlinemathlearning.com/dependent-events.html
    • http://www.onlinemathlearning.com/dependent-probability.html
    • http://www.learningwave.com/chapters/probability/dependent_independent.html
    • http://www.glencoe.com/sec/math/mac/mac01/course2/pdf/m_21304.pdf
    • http://www.glencoe.com/sec/math/prealg/mathnet/pr01/pdf/1009a.pdf
    • http://www.clickandclimb.com/content/mathcontent/prealgebra/pa-probability-of-independent-events.phpExtra
    • http://www.clickandclimb.com/content/mathcontent/prealgebra/pa-experimental-probability.phpExtra
    • http://www.glencoe.com/sec/math/studytools/cgi-bin/msgQuiz.php4?isbn=1-57039-850-X&chapter=10&lesson=1Game
    • http://www.mrnussbaum.com/probfair.htmDetermine
    • http://www.glencoe.com/sec/math/mac/mac01/course2/pdf/m_21303.pdfExpress
    • http://staff.argyll.epsb.ca/jreed/javaMath/data/probability/quests.htm
    • http://www.google.com/url?sa=t&source=web&ct=res&cd=8&ved=0CC4QFjAH&url=http%3A%2F%2Fplanetward.org%2Ffiles%2FSimple_Probability_Practice.doc&ei=JorvSvnBLIyzlAfiwPGlDg&usg=AFQjCNHaesjlFtmH2WvIDU-SJ_MYF-FklA&sig2=ZvVNs4NwCDQiaS5F8kZhGQ
    • http://www.bbc.co.uk/education/mathsfile/shockwave/games/fish.html
    • http://staff.argyll.epsb.ca/jreed/math8/strand4/4203.htm
    • http://www.ixl.com/math/practice/grade-6-probability-mix-of-dependent-and-independent-events
    • http://www.google.com/url?sa=t&source=web&ct=res&cd=8&ved=0CC4QFjAH&url=http%3A%2F%2Fplanetward.org%2Ffiles%2FSimple_Probability_Practice.doc&ei=JorvSvnBLIyzlAfiwPGlDg&usg=AFQjCNHaesjlFtmH2WvIDU-SJ_MYF-FklA&sig2=ZvVNs4NwCDQiaS5F8kZhGQGame
    • http://staff.argyll.epsb.ca/jreed/math8/strand4/4203.htmExtra

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
afb3b24f254994b42882e7c788d725c2f4ee91b9b7cceb6bcfda93bd7c6c9af8		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2399 bytes
Detection
ClamAV: Doc.Trojan.Thus-8
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.