Office (OLE) / .DOC malware analysis — malicious · 001ec1448c292ade

MALICIOUS

Office (OLE) / .DOC

78.0 KB Created: 2010-01-12 10:54:00 Authoring application: Microsoft Word 11.2

MD5: 698442f28fdf335c87a150070b24987c SHA-1: d404690fd92ff94f510f4fb089c49b509c725b43 SHA-256: 001ec1448c292ade2fd113029307ad1b42245730907c7b0f80934790910b7ea6

180 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic T1059.001 PowerShell

The file is a Microsoft Word document containing a VBA macro that executes upon opening, as indicated by the 'OLE_VBA_DOCOPEN' heuristic. The macro attempts to disable virus protection and ensure its own persistence by copying itself to the NormalTemplate and other open documents. The ClamAV detection 'Doc.Trojan.Thus-8' strongly suggests malicious intent, likely for downloading and executing additional malicious content.

Heuristics 4

ClamAV: Doc.Trojan.Thus-8 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-8
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `422edb566104aa14cde8340a2897d7f1ec40a431c2cfa7ed8d1faaf41f259056`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2347 bytes
Detection ClamAV: Doc.Trojan.Thus-8 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.