Office (OLE) malware analysis — malicious · c3bd2aefc3d845aa

MALICIOUS

Office (OLE)

41.0 KB Created: 2009-05-24 18:52:00 Authoring application: Microsoft Word 10.0

MD5: c7be57f28ac7435ab502ee22870d5c1a SHA-1: b3c3f4a71e86b0e0eecbbeba4a9c22750202ea1a SHA-256: c3bd2aefc3d845aa7a72d9c72959a5fb69158102aaf59a459385f5dc886baa23

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature 'Doc.Trojan.Thus-16'. Static analysis detected VBA macros, specifically a Document_Open macro, indicating a likely execution path upon opening the document. The presence of VBA macros suggests the document is intended to deliver a malicious payload, potentially through a macro-enabled download and execution chain.

Heuristics 3

ClamAV: Doc.Trojan.Thus-16 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-16
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0951067ec0d7ba2f0aa6f7c1516669d5554abc1d4352d7729967a891d3141d35`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1907 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.