Office (OLE) malware analysis — malicious · bdfceb3010dbaa6f

MALICIOUS

Office (OLE)

97.0 KB Created: 2000-11-17 00:58:00 Authoring application: Microsoft Word 8.0

MD5: 1c4bc48c9024d58793fc5b9238194e93 SHA-1: bcc3a890421ff89125756dde4eb99c2a82f4ecd3 SHA-256: bdfceb3010dbaa6fd54f9671c6732994ae34fb764122a65437a140f48b260073

200 Risk Score

Malware Insights

MITRE ATT&CK

T1204.001 Malicious Link T1059.005 Visual Basic

The file contains a high-severity heuristic indicating the presence of an Equation Editor OLE object, a known exploit vector. Additionally, VBA macros are detected, including AutoOpen and Auto_Close, suggesting malicious code execution upon opening or closing the document. ClamAV detection as 'Doc.Trojan.JulyKiller-3' further confirms its malicious nature. The document body, though containing technical text, is likely a lure to disguise the malicious intent.

Heuristics 5

Equation Editor OLE object high CVE related OLE_EQUATION_EDITOR

Contains Equation Editor object — related to CVE-2017-11882 / CVE-2018-0802 exploitation, but CLSID presence alone is not the malformed MTEF exploit primitive.
ClamAV: Doc.Trojan.JulyKiller-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.JulyKiller-3
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b3434d6eb487b3bb63e7d200f96a39378070b0d51d152171497f6c462e042104`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	26686 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.