MALICIOUS
100
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
The sample is a Microsoft Word document with a high-confidence detection for VBA macros, specifically triggering on AutoOpen and AutoClose macros. The document body presents itself as a 'SCAN Tool' to clean 'prank macros' but is designed to execute malicious VBA code upon opening. No specific IOCs like URLs or hashes were extracted, but the presence of AutoOpen and AutoClose macros indicates an attempt to execute malicious code automatically when the document is opened and potentially when it is closed.
Heuristics 3
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Auto_Close macro high OLE_VBA_AUTOCLOSEAuto_Close macro
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas20afdc068e4249a05e1c393ad776b5413d5a933dcde6a89885b6f9486e5952c2 |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 3842 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.