Office (OLE) / .DOC malware analysis — malicious · 6b77707104a1cac2

MALICIOUS

Office (OLE) / .DOC

37.0 KB Created: 2010-05-12 19:30:00 Authoring application: Microsoft Word 11.5.6

MD5: b81e020c806e615399099fd9d1335347 SHA-1: 9b64bce1a20bb0f8d84eeaf22e8f62f3d39798ea SHA-256: 6b77707104a1cac2fd09c5360d8bd9b77f9d97520f6adc0a987d76c5b97a4250

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Microsoft Word document containing VBA macros, specifically a Document_Open macro designed to evade antivirus and potentially achieve persistence. The macro attempts to disable virus protection and manipulate its own code within the NormalTemplate and other open documents. The ClamAV detection name 'Doc.Trojan.Thus-10' further confirms its malicious nature.

Heuristics 4

ClamAV: Doc.Trojan.Thus-10 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-10
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6bc034ea08a2f1f7e4090cb81775ab0cee8caa257673d0a63061f86e883edd7c`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2322 bytes
Detection ClamAV: Doc.Trojan.Thus-10 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.