Office (OLE) malware analysis — malicious · db6a6efa066d9dc4

MALICIOUS

Office (OLE)

29.5 KB Created: 2003-07-17 14:42:00 Authoring application: Microsoft Word 9.0

MD5: 716a891ce2972048b5d3a4954e8a2c77 SHA-1: db7920c6dc78610c1ebc728a1f19416643595193 SHA-256: db6a6efa066d9dc42cf2c89a0a2efb3cec64620ab16f6afc714677e6b01e7dd3

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is a Microsoft Word document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. The document body presents a fake travel offer for a hotel in Croatia, likely intended to trick the user into opening the document and enabling macros. The ClamAV detection 'Doc.Trojan.Xaler-1' further confirms its malicious nature. No specific IOCs like URLs or hashes were extracted from the provided evidence.

Heuristics 4

ClamAV: Doc.Trojan.Xaler-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Xaler-1
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `80f3163bb40efcbafd4a66fbcf10cce41ef499966b52c8e5ff34b1d770cd1ae5`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2471 bytes
Detection ClamAV: Doc.Trojan.Xaler-1 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.