Office (OLE) / .DOC malware analysis — malicious · bd8fc6e4ba28a16d

MALICIOUS

Office (OLE) / .DOC

29.0 KB Created: 2008-12-06 17:40:00 Authoring application: Microsoft Word 11.5.6

MD5: b754f62575b7b90a093cf4e443c95912 SHA-1: a301907caed7e0d313241360bc35faa4272630b2 SHA-256: bd8fc6e4ba28a16d89333ce747653e08e46217583feb2239ac86f5be2747e09e

120 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a malicious Microsoft Word document containing VBA macros. The 'Document_Open' macro is present, indicating that malicious code will execute automatically when the document is opened. ClamAV identified this as 'Doc.Trojan.Thus-16'. No specific IOCs were extracted, but the presence of auto-executing macros is a high-confidence indicator of malicious intent.

Heuristics 3

ClamAV: Doc.Trojan.Thus-16 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-16
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `ce0206fd0ea44a638967b051e20d359785f78d44698fb12a468fd86f2a16e206`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.