Doc.Trojan.Panther-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 f2791fb0ef7057b2…

MALICIOUS

Office (OLE)

46.5 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 049aae255bdbd53b74e15af1c8d6d5b6 SHA-1: cf7ef04f12cce9017290358af05c21d97785e009 SHA-256: f2791fb0ef7057b217ae3656c327a96dc0569a17a40375d67ab4b5757bbb9522
180 Risk Score

Malware Insights

Doc.Trojan.Panther-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file was detected as Doc.Trojan.Panther-2 by ClamAV, indicating malicious intent. The presence of a Document_Open macro and embedded VBA code strongly suggests that the document is designed to execute malicious code upon opening. The VBA code, though truncated, likely attempts to download and execute a secondary payload, a common tactic for this type of malware.

Heuristics 3

  • ClamAV: Doc.Trojan.Panther-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Panther-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29389 bytes
SHA-256: d01fb27b692a215ec851eec7906e6b03f14b4b7951bbfc88e8226f0320934f12
Detection
ClamAV: Doc.Trojan.Panther-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Sub hello()

End Sub
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWHTBSNT10\1CLJ4P_2 on NE00:CoodeEsdjw3456ot76 weor9w5834958313/11/99 08:31:27
'12/11/99 17:36:38\\SWHTBSNT10\6ALJ4P_2 on NE00:HayesJsdjw3456ot76 weor9w5834958312/11/99 17:36:38
'13/11/99 08:31:27\\SWH
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.