Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fd61a478f80cb43b…

MALICIOUS

Office (OLE)

217.5 KB Created: 2008-11-18 09:16:00 Authoring application: Microsoft Word 11.3.8
MD5: 299c7577bd462cfcb1b2527a095e7298 SHA-1: 1469c992c059fdb7067d8c6d82c9fade77209c9e SHA-256: fd61a478f80cb43b80ab0776ce060c762cd43d8dec2470491d0889985dd32058
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an OLE document containing VBA macros, specifically a Document_Open macro, which is a common technique for initial execution. ClamAV detections indicate the presence of a known trojan. The macros are likely designed to download and execute a second-stage payload, although the specific mechanism is not detailed in the provided heuristics. The embedded URL was confirmed benign and the document body content appears unrelated to the malicious functionality.

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-40 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-40
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.apple.com/DTDs/PropertyList-1.0.dtd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d41c9267beb7aeb9002f6cfedc0d926f627e1f4f0feade367b7ea63422dfcbca		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 4225 bytes
Detection
ClamAV: Doc.Trojan.Marker-2
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.