Office (OLE) / .DOCX malware analysis — malicious · d55bb02b6e10cfe0

MALICIOUS

Office (OLE) / .DOCX

41.0 KB Created: 2013-03-19 00:33:00 Authoring application: Microsoft Office Word

MD5: 81506503f4c55115762c54a5ee6734f2 SHA-1: bbc48d1087297965a29ff70243de4a11582ae86b SHA-256: d55bb02b6e10cfe06e628f70a9b526021744bc6f364629a7221a2b4a149db3d2

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is detected as malicious by ClamAV with the signature 'Doc.Trojan.Xaler-1'. It contains a VBA macro, specifically triggered by the 'Document_Open' event, which is designed to export its own code to 'C:\temp.tmp', read it back, and then re-insert it into the Normal template and the active document. This process is indicative of a downloader or a mechanism to ensure persistence or further execution of malicious code. The document body text appears to be a mix of Chinese and garbled characters, likely a lure for property rental information, which is a common social engineering tactic.

Heuristics 4

ClamAV: Doc.Trojan.Xaler-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Xaler-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `b8825fb2d3a210a96ffaf509aa4e45db62f6b6fa73dc8d5503356067a3c88ec8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2187 bytes
Detection ClamAV: Doc.Trojan.Xaler-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.