Office (OLE) malware analysis — malicious · 029a56ec33bd4997

MALICIOUS

Office (OLE)

33.0 KB Created: 2000-11-17 09:36:00 Authoring application: Microsoft Word 8.0

MD5: 2b5805d797c501c440162bd5ce535876 SHA-1: ff9df4c6eb351bc27cec8e79fa4dacdd5de25f3c SHA-256: 029a56ec33bd49974a4279dab8b79d91d68a2531c789398f3598ad5e6e68b05f

180 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is a Microsoft Word document containing VBA macros, specifically a Document_Open macro, which is a common technique for malicious documents. The ClamAV detection 'Doc.Trojan.Thus-8' strongly suggests malicious intent. The VBA script attempts to disable virus protection and copy itself to the NormalTemplate, indicating an attempt to establish persistence and potentially download further malicious content.

Heuristics 4

ClamAV: Doc.Trojan.Thus-8 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-8
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `856de4c880a20fc60daafc2cf4e0f85304b618863d8ba2d6ca620a05aca204a8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2433 bytes
Detection ClamAV: Doc.Trojan.Thus-8 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.