Office (OLE) malware analysis — malicious · d929fb5a4b638b8f

MALICIOUS

Office (OLE)

30.5 KB Created: 2008-07-16 15:11:00 Authoring application: Microsoft Word 10.0

MD5: e89b644684c807af8a3e3955531c5b18 SHA-1: d9e9dbf897b8d26e082e096df01354159e07f410 SHA-256: d929fb5a4b638b8f8d5911d231f3b380139bad884742f938954c54e8cd41bd3d

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Doc.Trojan.Title-1. Static analysis detected VBA macros within the document, which is a common delivery mechanism for malware. The document body content appears to be a product description for lighting fixtures and does not directly indicate malicious intent, suggesting the malicious functionality is solely within the macros.

Heuristics 3

ClamAV: Doc.Trojan.Title-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Title-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `8b4f3c0da8f19a947a457940c6447deaae03774d3cfd0f7df4547cfc16021ece`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2886 bytes
Detection ClamAV: Doc.Trojan.Title-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.