Office (OLE) malware analysis — malicious · 4866bf7db0d708d5

MALICIOUS

Office (OLE)

223.0 KB Created: 2007-07-25 15:09:00 Authoring application: Microsoft Word 11.3.5 First seen: 2014-12-09

MD5: 6132b5c113ce05d486dfb0fe13875451 SHA-1: 7e336f662aab6121cd67ad29f31ab12422137d19 SHA-256: 4866bf7db0d708d57ddb77260f9da1e6e75311b609c6b00a511c273a9e430a3f

210 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The document contains a form requesting personal details, suggesting a phishing attempt to harvest user information. The embedded VBA macro, specifically the `Document_Open` subroutine, attempts to disable virus protection and replicate itself by writing VBA project code. It also attempts to modify application settings and potentially log data, indicating malicious intent beyond simple phishing. The macro's self-replication and AV tampering heuristics are critical findings.

Heuristics 5

ClamAV: Doc.Trojan.Marker-13 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Marker-13
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Kill Options.DefaultFilePath(8) & "\*.dot"
Options.VirusProtection = False
Application.UserName = "JonMMx 2000"
```

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

Const Marker = "<- this is a marker! by jonhehehe TheBest-versi212x"
Private Sub Document_Open()
Document_Close

Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.apple.com/DTDs/PropertyList-1.0.dtd In document text (OLE body)
- http://ns.adobe.com/xap/1.0/In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/exif/1.0/In document text (OLE body)
- http://ns.adobe.com/tiff/1.0/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Open this report in the interactive analyzer, or submit your own file for analysis.