Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f15bad7b5e210729…

MALICIOUS

Office (OLE)

64.0 KB Created: 2009-09-04 22:52:00 Authoring application: Microsoft Word 11.5.0
MD5: 85813234d261e49fe9e05ce6fe24cc26 SHA-1: 068baa42b24e82899c097e212b6674e39a495763 SHA-256: f15bad7b5e210729abbcbca053f2c6097c2fec77163b52d51bf0e368010dd8ee
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The sample is a malicious Office document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. The document body contains a hyperlink to a suspicious URL, suggesting a social engineering lure to direct the user to a potentially malicious website. The presence of VBA macros and the embedded URL indicate an attempt to deliver a payload or redirect the user to a compromised site.

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-40
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.abbynet.sd34.bc.ca/~asiahigh

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
bb48a3dc76319d44983cd2eb75e9601483182977e5e1d0d0f8c8907ce863c00d		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 4285 bytes
Detection
ClamAV: Doc.Trojan.Marker-2
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.