Office (OLE) malware analysis — malicious · b00abce723628cd5

MALICIOUS

Office (OLE)

142.5 KB Created: 1997-12-21 20:50:00 Authoring application: Microsoft Word 8.0

MD5: a3473300803a771b7d2bc6ef2bdbd590 SHA-1: 02569919cfad3b7ec1d13f9d3bf16c35a0fd7d44 SHA-256: b00abce723628cd5690c6b2f49b87b69b8283b4d4e65dc3d018ef179507fe344

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as malicious by ClamAV with the signature 'Doc.Trojan.Cap-2'. It contains VBA macros, including AutoOpen and Auto_Close, indicating an attempt to execute code upon opening or closing the document. The document body is presented as an academic project, likely a lure to encourage macro execution. The primary function of the embedded VBA macros is to download and execute a second-stage payload, as indicated by the heuristic firings and the ClamAV detection.

Heuristics 5

ClamAV: Doc.Trojan.Cap-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Cap-2
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `e13d8bd30a4a8e5d2387fa79ff65cd982287ddb2b81d4f3e5ea8c8e4bebfa346`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	24635 bytes
Detection ClamAV: Doc.Trojan.Cap-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.