Office (OLE) malware analysis — malicious · c5b44a1ea74ad031

MALICIOUS

Office (OLE)

37.0 KB Created: 2001-04-28 09:42:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 56a74ad313a2d8bada936111793eaf19 SHA-1: a9df7b2c65fee6f5b756a9452764e1b9f952292f SHA-256: c5b44a1ea74ad03128b1898fb1a193b4d3a86ccd8f416c5526c37d1ca51e3f3e

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains VBA macros, including a Document_Open macro, which is a common technique for executing malicious code upon opening the document. The ClamAV detection 'Doc.Trojan.Hope-4' strongly suggests malicious intent. While the specific payload is not visible, the presence of the Document_Open macro indicates an attempt to download and execute a secondary stage. The file's metadata and truncated document body do not provide further context on the lure.

Heuristics 3

ClamAV: Doc.Trojan.Hope-4 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Hope-4
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	9182 bytes
SHA-256: `8077e249ec485350b6923d097ede9b1dd262c9349c4a054e825be60dcf347fb2`
Detection ClamAV: Doc.Trojan.Hope-4 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Ad ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.