Doc.Trojan.Thus-8 — Office (OLE) malware analysis

Static analysis result for SHA-256 5e75449581384eb2…

MALICIOUS

Office (OLE)

1.58 MB Created: 2009-10-08 02:50:00 Authoring application: Microsoft Word 11.3
MD5: a0db4d89b24945ae20af8cd5ef8e11be SHA-1: 2a8b516aaaee7fd3b2f104a94b621888655a1974 SHA-256: 5e75449581384eb257b65efbd8ae4d7e43cd2bebe00858a59512a3afbdfc6dd9
180 Risk Score

Malware Insights

Doc.Trojan.Thus-8 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Trojan.Thus-8. It contains a VBA macro within the Document_Open subroutine, which is designed to execute automatically when the document is opened. The macro attempts to disable virus protection and ensure its own persistence by modifying the NormalTemplate and other open documents. The presence of the Document_Open macro and the ClamAV detection strongly indicate a malicious document dropper.

Heuristics 4

  • ClamAV: Doc.Trojan.Thus-8 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Thus-8
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
e740794a412f9397d0507cbdaed2702779d4e217ac4829e198ede5846d5df063		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2357 bytes
Detection
ClamAV: Doc.Trojan.Thus-8
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.