Office (OLE) / .DOC malware analysis — malicious · bf65d7289ddb7bc1

MALICIOUS

Office (OLE) / .DOC

145.0 KB Created: 2005-03-18 11:22:00 Authoring application: Microsoft Office Word

MD5: 6bc8740cd1d126643d572736e975ca28 SHA-1: 8efd16c983d68f19593ca4b0f4049736505ea5a4 SHA-256: bf65d7289ddb7bc1ce1f16d6fe7e5afdafec976af4488234f9a7eeb5fe467f95

160 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1566.001 Spearphishing Attachment

The file is a malicious Microsoft Word document containing VBA macros, specifically triggering AutoOpen and Auto_Close events. ClamAV identifies it as Doc.Trojan.CrazyMan-1. The document body appears to be a list of metrology equipment and calibration certificates, likely serving as a lure. No scripts were extracted, but the presence of AutoOpen/Auto_Close macros strongly suggests the execution of malicious code upon opening or closing the document.

Heuristics 4

ClamAV: Doc.Trojan.CrazyMan-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.CrazyMan-1
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `418a8f2c1b5f7a96fcb905e5ab29066ce8bc21aa1dacc56be4bc43d4935560b1`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2959 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.