Office (OLE) malware analysis — malicious · b84058cd363aaf4f

MALICIOUS

Office (OLE)

30.5 KB Created: 2008-07-16 16:58:00 Authoring application: Microsoft Word 10.0

MD5: 03d3b8407c9b587cb8f4606037bcb7a8 SHA-1: de8a73b377f775857f16aeb84c48c8a6eaa0c45c SHA-256: b84058cd363aaf4f4e5d5e643b099cd3204c18d6c695c1c7ab97eeb2fee0b797

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Doc.Trojan.Title-1. Static analysis detected VBA macros within the document, indicating a likely attack vector. The presence of these macros suggests the document is designed to execute arbitrary code, potentially downloading and running a secondary payload.

Heuristics 3

ClamAV: Doc.Trojan.Title-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Title-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `8b4f3c0da8f19a947a457940c6447deaae03774d3cfd0f7df4547cfc16021ece`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2886 bytes
Detection ClamAV: Doc.Trojan.Title-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.