Office (OLE) malware analysis — malicious · 75abb7531553ba44

MALICIOUS

Office (OLE)

32.0 KB Created: 2007-01-10 12:39:00 Authoring application: Microsoft Word 10.0

MD5: ead7a0e22049d8bb2f94151546034d16 SHA-1: 0b28f94b2aa7310a5db74427ff793e60d69f5b06 SHA-256: 75abb7531553ba4494853f0fdb6b0ec2709045bf0f605a6d2e02464fedf34b8e

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an OLE document containing VBA macros, specifically triggering on the Document_Open event. Heuristics indicate the presence of malicious macros and ClamAV detection confirms this, identifying it as 'Doc.Trojan.Thus-8'. The macro code appears to be designed to copy itself to the Normal template and other open documents, a common persistence or propagation technique. The truncated script suggests it may attempt to download further content.

Heuristics 4

ClamAV: Doc.Trojan.Thus-8 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-8
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6ab2261a029f9d9ab697f4c911d4e2e374176c8c995f3ac03e77ca0914d56344`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2383 bytes
Detection ClamAV: Doc.Trojan.Thus-8 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.