Melissa Office (OLE) / .DOC malware analysis — malicious · e27a3a6edb6f5c4e

MALICIOUS

Office (OLE) / .DOC

106.5 KB Created: 2001-04-11 01:18:00 Authoring application: Microsoft Word 8.0

MD5: b39555c8ab6f54d811c09203975b4d9d SHA-1: 8e2ffc0a6cfe6b449c4f058ab83e7760cba3c288 SHA-256: e27a3a6edb6f5c4ef24cef561296942a1b18125df21f4b64df9ff290036a0ef6

380 Risk Score

Malware Insights

Melissa · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1059.003 Windows Command Shell T1204.002 Malicious File

The sample is a Microsoft Word document containing a significant amount of VBA macro code, including AutoOpen, Document_Open, and Auto_Close functions. Critical heuristics indicate the presence of Shell() and CreateObject() calls within the VBA, suggesting execution of external commands. ClamAV detection of 'Doc.Trojan.Melissa-4' strongly points to the Melissa virus family. The extracted artifact 'macros.bas' is likely the malicious macro code. The document body appears to be academic references, likely a lure.

Heuristics 9

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 109,056 bytes but its declared streams total only 36,887 bytes — 72,169 bytes (66%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `36cc5818bd6d9d9655e8af98a6c81d943d8d5861fb8471419815b3f4820ebd35`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	21043 bytes
Detection ClamAV: Doc.Trojan.Melissa-4 Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.