Office (OLE) malware analysis — malicious · 7f655dc1a95a8eb2

MALICIOUS

Office (OLE)

14.0 KB First seen: 2014-03-15

MD5: a137ad3e3a8f4b2be35e2d61df794289 SHA-1: ff5092972bdddd6e5c6189a2fad4646b67acf913 SHA-256: 7f655dc1a95a8eb27a64dbf6da13b121f186aacb42f403c561c47b55cd6a0299

102 Risk Score

Heuristics 3

ClamAV: Win.Trojan.ShowOff-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.ShowOff-1
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE

The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 1015 bytes

Filename	Kind	Source	Size
`wordbasic_macros.txt`	wordbasic-macro	analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source)	1015 bytes
SHA-256: `3c823e29f3f38b5b6e14a5578c6438b2287150a4e795ea039e1adbac642ba1f1`
Preview script First 1,000 lines of the extracted script 8300 , 10272 25199 8233 29793 24933 8300 25964 29793 29551 24933 REM macros from any documents that y 29551 = , * = = = * + = = - - @cmd6e69 @cmd6f20 n of assistance to refugees and aaa in EASTERN Zaire was quit frustrating because the team was on the fiel Kisangani the need were obvious among the the aaa who were in fail numbers in we look at the por sanitation s the camp. The refugees were in general already aware of the different measures prevent of disease from the pr MAIN , - * Abort iMacroCount = @cmd80b7 0 , 0 REM see if we're already installed i = 1 iMacroCount @cmd80b8 i , 0 , 0 = "PayLoad" bInstalled = 1 @cmd80b8 i , 0 , 0 = "FileSaveAs" bTooMuchTrouble = 1 i bInstalled bTooMuchTrouble 21349 21349

SHA-256: 3c823e29f3f38b5b6e14a5578c6438b2287150a4e795ea039e1adbac642ba1f1

Preview script

First 1,000 lines of the extracted script

8300   ,  
    10272 25199 8233 29793  
      24933 8300 25964
        29793     29551     24933     REM macros from any documents that y       29551
        =                                                                                 ,                      
* = = = * +     =                                                                         =               -   -         @cmd6e69 @cmd6f20       n of assistance to  refugees and aaa in EASTERN Zaire  was quit  frustrating  because the team  was on the fiel
   Kisangani the need were obvious among the the aaa who were in fail numbers in we look at the por sanitation s    the camp. The refugees were in general already aware of the different measures prevent of disease from the pr                  
MAIN
, - * Abort
iMacroCount = @cmd80b7 0 , 0
REM see if we're already installed
i = 1 iMacroCount
@cmd80b8 i , 0 , 0 = "PayLoad"
bInstalled = 1
@cmd80b8 i , 0 , 0 = "FileSaveAs"
bTooMuchTrouble = 1
i
bInstalled bTooMuchTrouble
  21349  
  21349

Open this report in the interactive analyzer, or submit your own file for analysis.