Office (OLE) malware analysis — malicious · d3beed974e1d594b

MALICIOUS

Office (OLE)

28.5 KB Created: 2010-09-12 22:02:00 Authoring application: Microsoft Word 10.1

MD5: 4c5b52de6b88c740eb7fc7d311474b50 SHA-1: 91bd55a986747528ab0f49df09f1458429ee6188 SHA-256: d3beed974e1d594bb319178ab1913e13695dc61257632e56e753cb965f21043c

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature 'Doc.Trojan.Thus-16'. Static analysis detected VBA macros, specifically a 'Document_Open' macro, indicating that the document is designed to execute code upon opening. The document body presents itself as an invoice, a common social engineering tactic to encourage user interaction with malicious content. The presence of the 'Document_Open' macro suggests the intent is to run malicious code automatically, likely for further payload delivery or system compromise.

Heuristics 3

ClamAV: Doc.Trojan.Thus-16 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-16
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `790b16052dcca147354d20827a4bd02efa8a1d6a56ee9d175a7b21daa819a815`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1959 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.