Office (OLE) malware analysis — malicious · f2fa655a50243559

MALICIOUS

Office (OLE)

38.5 KB Created: 2010-09-09 13:16:00 Authoring application: Microsoft Word 10.1

MD5: e2b6d68b4691881e07858b9b2385a8dc SHA-1: 0ce2d2e6d42104727b6c7ef11f98063ed6d786a5 SHA-256: f2fa655a50243559bc7fb0f30e7590fefe040ebd28f0d0ffa1b0c000ee3e8e96

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 Malicious File

The file is a Microsoft Word document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. The document body is crafted to appear as legitimate class information, likely to trick the user into enabling macros. The presence of VBA macros and the Document_Open execution trigger strongly suggest a macro-based malware delivery. No specific family could be identified, and no external IOCs were extracted.

Heuristics 4

ClamAV: Doc.Trojan.Thus-8 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-8
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `06a86dd3f055fe45ead6941738a78f871007578c5986178f904ec22b910cb6dc`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2351 bytes
Detection ClamAV: Doc.Trojan.Thus-8 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.