Office (OLE) / .DO malware analysis — malicious · f1046b23baa6c0c8

MALICIOUS

Office (OLE) / .DO

150.0 KB Created: 1999-07-07 04:06:00 Authoring application: Microsoft Word 8.0

MD5: be1a73c6a778c1d9f152f426fe376b9a SHA-1: dea8682cae1fb4897cdb6dd248e9e673158d7acf SHA-256: f1046b23baa6c0c8764dd94b9ec49eabd6a9f6a5daea3e53117ad4ed3753455d

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1566.001 Spearphishing Attachment

The file is a Microsoft Word document containing VBA macros, specifically an AutoOpen macro, which is a common technique for initial execution. Heuristics indicate the presence of malicious VBA macros and a critical ClamAV detection on an extracted artifact, identified as Win.Trojan.C-286. The document body discusses business intelligence software, likely a lure to encourage macro execution. The AutoOpen macro is designed to run malicious code upon opening the document, leading to the execution of the detected trojan.

Heuristics 3

ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `014f4e60fcd6286b16caa350d7fe4ec17ce30341c8a13561024b2b783de6100a`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4716 bytes
Detection ClamAV: Win.Trojan.C-286 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.