Office (OLE) / .DOC malware analysis — malicious · 9b8bc342bc33158a

MALICIOUS

Office (OLE) / .DOC

29.0 KB Created: 2005-07-08 09:20:00 Authoring application: Microsoft Office Word

MD5: 1e0e799a22e15e012aa262a7fd3b87fd SHA-1: 7d1a2f4a9a31315ecc7e0d7d59dc9b6bb462d85c SHA-256: 9b8bc342bc33158ac3df903bb6b04c79000cfb93c036c3edf0936de40e7ee0b5

300 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell

The file is a malicious OLE document containing VBA macros. Heuristics indicate the presence of Shell(), CreateObject(), and CallByName() functions, strongly suggesting the execution of arbitrary code. The ClamAV detection of 'Win.Trojan.W-417' further confirms its malicious nature. The primary attack pattern involves leveraging VBA to execute shell commands, likely for downloading and executing a second-stage payload.

Heuristics 8

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV: Win.Trojan.W-417 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.W-417
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
CallByName call high OLE_VBA_CALLBYNAME

CallByName call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.microsoft.com/office/officeart/2005/8/oartml

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `61ecf70bdea450759d5a1d755574a08100fe9e8400f71d92cd95012618ba4020`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1096 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.