Office (OLE) malware analysis — malicious · 863d4a8fd852abf0

MALICIOUS

Office (OLE)

51.5 KB Created: 2009-07-08 15:04:00 Authoring application: Microsoft Word 10.0

MD5: e7960fe7868d33b9778a9eaf395c6475 SHA-1: 0da355b168ac12446b3588dd8c859ffe5f41c54e SHA-256: 863d4a8fd852abf084d8839445db075a98e66b2933c19b04189bc57a57e4f4ea

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Doc.Trojan.Thus-10. It contains VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon opening the document. The presence of this macro suggests the document is designed to download and execute a secondary payload, although the specific payload or its delivery mechanism is not detailed in the provided evidence. The document body appears to be a CV, which could be used as a lure.

Heuristics 4

ClamAV: Doc.Trojan.Thus-10 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-10
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6352b8401e657134ad8607afb730de810003296b433635efffcff269cc949031`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2273 bytes
Detection ClamAV: Doc.Trojan.Thus-10 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.