Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c425e8cfc9fd53e9…

MALICIOUS

Office (OLE)

215.0 KB Created: 2008-11-19 17:03:00 Authoring application: Microsoft Word 11.3.8
MD5: 4a87bf84b5603e2c8f8b4e0413f39a7c SHA-1: 8111a8c189d84f5de18a0b385d8408222966d06b SHA-256: c425e8cfc9fd53e944f878bb509758b8ea33b0187d5b221e5e492f7a1231eac3
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as malicious by ClamAV with multiple critical heuristic firings indicating the presence of VBA macros. Specifically, the 'Document_Open' macro is present, which is a common technique for executing malicious code upon opening the document. The presence of the 'macros.bas' file further confirms the macro content. The document body appears to be corrupted or contains obfuscated characters, preventing a clear understanding of its lure, but the macro presence strongly suggests a downloader or dropper functionality.

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-40
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.apple.com/DTDs/PropertyList-1.0.dtd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d41c9267beb7aeb9002f6cfedc0d926f627e1f4f0feade367b7ea63422dfcbca		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 4225 bytes
Detection
ClamAV: Doc.Trojan.Marker-2
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.