Office (OLE) malware analysis — malicious · c6bc693dfb836671

MALICIOUS

Office (OLE)

212.5 KB Created: 2008-11-17 20:12:00 Authoring application: Microsoft Word 11.3.8

MD5: f01c2bddf97f703c311d3bd71d4b0ffc SHA-1: 0dffd00345ad49dfb0b4c48d6843aa7afa78aaa1 SHA-256: c6bc693dfb836671273d26d182734230fdb6207f90439b2d21296f8c28e4018b

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as malicious by ClamAV with multiple signatures indicating it's a trojanized document. The presence of a Document_Open macro strongly suggests that the VBA code within the file is intended to execute automatically upon opening. No scripts were extracted, and the document body content appears to be unrelated to the malicious functionality, indicating the malicious payload is likely within the VBA macros themselves.

Heuristics 5

ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Marker-40
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://www.apple.com/DTDs/PropertyList-1.0.dtd

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d41c9267beb7aeb9002f6cfedc0d926f627e1f4f0feade367b7ea63422dfcbca`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4225 bytes
Detection ClamAV: Doc.Trojan.Marker-2 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.