Office (OLE) / .DOC malware analysis — malicious · bb523d83ce739737

MALICIOUS

Office (OLE) / .DOC

32.5 KB Created: 2016-05-12 06:23:00 Authoring application: Microsoft Office Word First seen: 2026-06-25

MD5: caebff14423ea917f52d631d6c735ac3 SHA-1: e12c35d2495ee054652164ae232629dc6cff2429 SHA-256: bb523d83ce73973783a51a79ec5ec3060ab8c3d29f316cb3dbaadf6169e88517

250 Risk Score

Heuristics 8

ClamAV: Doc.Malware.Prince-6784184-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Prince-6784184-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA
Matched line in script
```
    Shell "cmd.exe /K echo " + eicarPart1 + eicarPart2
```
cmd.exe reference in VBA high OLE_VBA_CMD

cmd.exe reference in VBA
Matched line in script
```
    Shell "cmd.exe /K echo " + eicarPart1 + eicarPart2
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Suspicious cmd.exe invocation with execution flag high SC_STR_CMD

Suspicious cmd.exe invocation with execution flag
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://github.com/mattias-ohlsson/eicar-standard-antivirus-test-files In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 680 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	680 bytes
SHA-256: `0c7d0895dcfbe6dcda4ea6640a85594f0d8474ce2f835c389f705f6b7d3deee0`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "NewMacros" Sub AutoOpen() ' https://github.com/mattias-ohlsson/eicar-standard-antivirus-test-files ' Simple obfuscation Dim eicarPart1 As String Dim eicarPart2 As String eicarPart1 = "X5O!P%@AP[4\PZX54(P^^)7C" eicarPart2 = "C)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" Shell "cmd.exe /K echo " + eicarPart1 + eicarPart2 End Sub

SHA-256: 0c7d0895dcfbe6dcda4ea6640a85594f0d8474ce2f835c389f705f6b7d3deee0

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
    ' https://github.com/mattias-ohlsson/eicar-standard-antivirus-test-files

    ' Simple obfuscation
    Dim eicarPart1 As String
    Dim eicarPart2 As String
    eicarPart1 = "X5O!P%@AP[4\PZX54(P^^)7C"
    eicarPart2 = "C)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"

    Shell "cmd.exe /K echo " + eicarPart1 + eicarPart2
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.