Malicious Office (OLE) — malware analysis report

Heuristics 6

• ClamAV: Doc.Trojan.Marker-35 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Doc.Trojan.Marker-35
• VBA macros detected medium 2 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
  VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
  Matched line in script

  Kill Options.DefaultFilePath(8) & "\*.dot"
  Options.VirusProtection = False
  Application.UserName = "JonMMx 2000"

• Document_Open macro low OLE_VBA_DOCOPEN
  Document_Open macro
  Matched line in script

  Const Marker = "<- this is a marker! by jonhehehe TheBest-versi212x"
  Private Sub Document_Open()
  Document_Close

• Urgency / deadline lure low SE_URGENCY_LURE
  Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.grbtv.com In document text (OLE body)

  • http://www.iec.chIn document text (OLE body)
  • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.