Office (OLE) malware analysis — malicious · ca6dd5ea402d6a2d

MALICIOUS

Office (OLE)

30.5 KB Created: 2008-07-16 17:02:00 Authoring application: Microsoft Word 10.0

MD5: f05ac17552cbb49f2ea29ecd6df23864 SHA-1: ebe13e834a92ec1fb2e99060487b7ca7701072d4 SHA-256: ca6dd5ea402d6a2dc46a12dcda6770fb1ef3943ba2f23b59e27c9921f258a7e1

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Doc.Trojan.Title-1. Static analysis detected VBA macros within the document. The document body presents itself as technical specifications for a display product, likely a lure to encourage users to enable macros. The presence of VBA macros suggests the document is designed to execute malicious code, potentially downloading a second-stage payload.

Heuristics 3

ClamAV: Doc.Trojan.Title-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Title-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `8b4f3c0da8f19a947a457940c6447deaae03774d3cfd0f7df4547cfc16021ece`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2886 bytes
Detection ClamAV: Doc.Trojan.Title-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.