Office (OLE) / .DOC malware analysis — malicious · c6ca63e62af74ded

MALICIOUS

Office (OLE) / .DOC

2.10 MB Created: 2010-08-02 04:02:00 Authoring application: Microsoft Word 11.5.6

MD5: d5f91f655b43804a81d3e5d203240b8e SHA-1: a1f27c120914c059e691aad3bf2978c09f67805b SHA-256: c6ca63e62af74ded1206db9fc63884ba232a7168d4970246d49f5b19f13f6665

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is a Microsoft Word document containing VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon opening. The document body presents a list of Java programming tutorial topics, likely as a lure to encourage macro execution. The presence of a Document_Open macro indicates an attempt to automatically run code, and the ClamAV detection as 'Doc.Trojan.Thus-5' confirms its malicious nature. No specific IOCs like URLs or hashes were extracted from the macro itself.

Heuristics 4

ClamAV: Doc.Trojan.Thus-5 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-5
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d1c160e4f4c042a10ebadf02750db332ad13ad0330ae1ea81d3600fe5b947cd4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2389 bytes
Detection ClamAV: Doc.Trojan.Thus-5 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.