Office (OLE) / .DOC malware analysis — malicious · ef712286c38c58d9

MALICIOUS

Office (OLE) / .DOC

51.5 KB Created: 2004-12-07 12:05:00 Authoring application: Microsoft Word 9.0

MD5: 54699915c83873303351989ace215e13 SHA-1: fb0923846dc5de11ee7893676c0be6d0dd3f54a2 SHA-256: ef712286c38c58d9b4265a00859b7eb3ade2e6333cd890e857994d9b4d6fca39

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a Microsoft Word document containing VBA macros, specifically triggering AutoOpen, Document_Open, and Auto_Close events. ClamAV detections indicate it is a known malicious document (Doc.Trojan.Thus-10 and Doc.Trojan.Titch-3). The presence of these auto-executing macros strongly suggests the document's purpose is to run malicious code upon opening, likely to download and execute a second-stage payload.

Heuristics 6

ClamAV: Doc.Trojan.Thus-10 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-10
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `c21d3bc5f079e3a335e2a459bd52c3e3f422af8698d910e9571afabccd0a9540`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4956 bytes
Detection ClamAV: Doc.Trojan.Titch-3 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.