Office (OLE) / .DOCX malware analysis — malicious · c333476140b07d61

MALICIOUS

Office (OLE) / .DOCX

70.0 KB Created: 2001-05-31 12:35:00 Authoring application: Microsoft Word 8.0

MD5: 509f14a58474d791244a7bd791ea507c SHA-1: a543d8be458600fc37c994b1759f7b851bdfd5e4 SHA-256: c333476140b07d61743fcc9d6ebd3dfc96c1041d745ed7157758b4546ab85388

320 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Microsoft Word document containing VBA macros. The AutoOpen macro is designed to copy itself and other macros (FileSave, FileSaveAs, FilePrint, etc.) into the user's Normal.dot template, potentially establishing persistence or enabling further malicious actions. The presence of `Shell()` calls and the ClamAV detection as 'Doc.Trojan.Angus-2' strongly indicate malicious intent. The macro code attempts to modify the Normal.dot template and copy itself, suggesting an attempt to establish persistence or a backdoor.

Heuristics 7

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV: Doc.Trojan.Angus-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Angus-2
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `4cc13e125ab7b7d2576e384845ef4f6f0e4316f3c724fb11388569d4d824d475`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	43908 bytes
Detection ClamAV: Doc.Trojan.Angus-2 Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.