Office (OLE) / .DOC malware analysis — malicious · e928991d44738a6d

MALICIOUS

Office (OLE) / .DOC

321.5 KB Created: 2010-06-24 18:30:00 Authoring application: Microsoft Word 11.5.6

MD5: b88c70d5a504e2e52bf359112e4352de SHA-1: d8d001cc1e1d927491f23d7a980750c714f075f8 SHA-256: e928991d44738a6db454b2b96b9f03733e279340d6d28073077c469853799b87

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic for Applications T1204.002 Malicious File

The sample is a Microsoft Word document containing VBA macros, specifically a Document_Open macro, which is a common technique for initiating malicious activity upon opening the file. The document body presents a non-circumvention and non-disclosure agreement, a common lure to trick users into enabling macros. The presence of ClamAV detections (Doc.Trojan.Thus-8) further confirms its malicious nature. The primary attack vector appears to be macro execution to download and run a secondary payload.

Heuristics 4

ClamAV: Doc.Trojan.Thus-8 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-8
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `6cebe72d9808313a9c55b49f01ada15b0e62478f34b48b3401c5c81cdbefb331`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2337 bytes
Detection ClamAV: Doc.Trojan.Thus-8 Obfuscation or payload: unlikely
`ole10native_00.bin` `5b3ee3e0d5e743dd469dc72234e536dc2097ef5a45a73ae86a9a4b72608d3156`	ole-package	OLE Ole10Native stream: ObjectPool/_1298821147/Ole10Native	114692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.