Office (OLE) malware analysis — malicious · cd65250cef18fda3

MALICIOUS

Office (OLE)

25.0 KB Created: 2009-09-16 18:53:00

MD5: 0f5924a599da25a268c5ecbd4b35d273 SHA-1: 1881d61b0f2b1b8297f37c797b752a3e188e603e SHA-256: cd65250cef18fda3a31b4945687faeb860673793efc08afc284fab1518a482fa

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is an Office document containing VBA macros, specifically a Document_Open macro which is designed to execute automatically when the document is opened. ClamAV signatures also identify this as malware. No specific family could be identified, and no further IOCs were extracted.

Heuristics 4

ClamAV: Doc.Trojan.Thus-10 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-10
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `44c8e56af833df1561d8542ac02f0513a9efaed8fe87ad6afbdd5ec6233285a4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2274 bytes
Detection ClamAV: Doc.Trojan.Thus-10 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.