Office (OLE) / .DOC malware analysis — malicious · 9ebf60ad31f0eb1f

MALICIOUS

Office (OLE) / .DOC

19.5 KB Created: 2023-03-31 04:44:00 Authoring application: Microsoft Office Word4Normal.dotm@

MD5: 4fd8d5da5cd2109c730052735c9ccbb6 SHA-1: 2d175610936cdfc27380c13d89f5883db532d2b2 SHA-256: 9ebf60ad31f0eb1fa303e0b00f9cc605c5013ea30771e6b14409cb70af7416cb

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1204.002 Malicious File

The file is a Microsoft Office document containing a VBA macro. The 'Document_Open' macro heuristic indicates that the macro is designed to execute automatically when the document is opened. The presence of a 'CreateObject' call and a large, encoded blob within the macro suggests it is likely a downloader for a second-stage payload. No specific family could be identified, but the execution method is clear.

Heuristics 4

Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `613c2e50f27c40204b592508c75f424c5e2fb583e6ed018d69348de4e16b6bde`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	10401 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 7 long base64-like blob(s). Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.