Doc.Trojan.Thus-8 — Office (OLE) malware analysis

Static analysis result for SHA-256 706f81e2c09f393a…

MALICIOUS

Office (OLE)

42.0 KB Created: 2009-02-02 16:47:00 Authoring application: Microsoft Word 11.2
MD5: 5b1482135dc91c13b86bb712b5a6e325 SHA-1: 712282940f69a63da4757560a423dbae9cde8dfb SHA-256: 706f81e2c09f393a28373febb2a26c706cd63264d5e094ffa0cbf212bc23d828
180 Risk Score

Malware Insights

Doc.Trojan.Thus-8 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Trojan.Thus-8. It contains a VBA macro within the Document_Open subroutine that attempts to disable virus protection and copy itself to the Normal template, likely to establish persistence or facilitate further execution. The macro's logic suggests it is designed to download and execute a second-stage payload.

Heuristics 4

  • ClamAV: Doc.Trojan.Thus-8 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Thus-8
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
588a321bc75a5ae4e5725821dec576a3355fde580c6308b43a6d085be431a441		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 2375 bytes
Detection
ClamAV: Doc.Trojan.Thus-8
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.