Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e7a001b794ad5390…

MALICIOUS

Office (OLE)

212.0 KB Created: 2008-11-17 20:00:00 Authoring application: Microsoft Word 11.3.8
MD5: ea09915148d2c52db14a1bb2c048c634 SHA-1: 03f84de931b0e5551d444f2a55961e6aa9cd9e43 SHA-256: e7a001b794ad53902e21f2a79b4f084652448e02aa0ffb2ab7e4c273f380f5ae
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as malicious by ClamAV with multiple critical heuristic firings indicating the presence of VBA macros and a Document_Open macro. The 'macros.bas' file extracted from the sample contains VBA code, which is the likely vector for exploitation. The embedded URL was confirmed as benign, and no other IOCs were extracted. The primary attack pattern involves leveraging the Document_Open macro to execute malicious VBA code, likely for downloading and executing a second-stage payload.

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-40
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.apple.com/DTDs/PropertyList-1.0.dtd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d41c9267beb7aeb9002f6cfedc0d926f627e1f4f0feade367b7ea63422dfcbca		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 4225 bytes
Detection
ClamAV: Doc.Trojan.Marker-2
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.