Office (OLE) malware analysis — malicious · b3bd2ee0f6e9a5fc

MALICIOUS

Office (OLE)

74.5 KB Created: 2000-03-30 10:58:00 Authoring application: Microsoft Word 8.0

MD5: bbc2069e7eb07018567f3dbd1e1b4cf9 SHA-1: 997123d7d0f4403566d6e0f39dc121ec049848fb SHA-256: b3bd2ee0f6e9a5fc7f738b40cf58f5bff45c3a2c3d8092ac0dcd7bceb8de093f

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as malicious by ClamAV with multiple signatures, indicating it's a known trojan. The presence of VBA macros, detected by heuristics, is the primary mechanism for delivering the malicious payload. The document body appears corrupted, suggesting it's a wrapper for the embedded macro. No specific IOCs beyond the ClamAV signatures were extracted.

Heuristics 3

ClamAV: Doc.Trojan.Ethan-20 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Ethan-20
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `abf138dd96f469e9364e745f0a42615d30e305ef19f796789f8bf6e48cee9e96`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6272 bytes
Detection ClamAV: Doc.Trojan.Ethan-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.