Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a29e908d88006bd9…

MALICIOUS

Office (OLE)

7.0 KB First seen: 2012-06-14
MD5: 4d9281d0e53f83ed1b0d3dacb9d8684d SHA-1: 74b2f6b950cc31a3000118d418991f2599c096e4 SHA-256: a29e908d88006bd9939a51676c3276329d126c27e42e2f0ed96ac114e076ccd9
102 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, specifically identified by 'RSN MACRO VIRUS' markers and ClamAV detection as Win.Trojan.Chiao-1. The document body contains embedded file paths and error messages, suggesting an attempt to obfuscate its malicious nature or exploit legacy vulnerabilities. No specific scripts were extracted, but the presence of WordBasic macro virus markers points to the use of Visual Basic for malicious execution.

Heuristics 3

  • ClamAV: Win.Trojan.Chiao-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Chiao-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE
    The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 1044 bytes
SHA-256: 660868e1bbac804a289f9492a305550b0d8cd16918b9371814d72d9269166692
Preview script
First 1,000 lines of the extracted script
,      
    26465 29551      
MAIN
dlg @cmd0050
, - * Fehler
dlg
dlg
SF = @cmd802b "Zu wenig Arbeitsspeicher!" = @cmd8005 13 = 25961     25964   30049
@cmd6e65 = @cmd8005 13 = "!! Es besteht die Gefahr von Datenverlusten !!" , "Winword" , 273
SF = 0 * Ciao
@cmd0050 dlg
* Ciao
29285
Err 102 * Ciao
MAIN
Doku$ = @cmd8025
dlg @cmd0054
, - * Fehler
dlg
dlg
dlg = 0 dlg = 1
@cmd0054 dlg
Doku$ = @cmd8025
@cmd00de , = "c:\datei.doc" ,
= Doku$ ,
= , = 3
@cmd00de , = "c:\datei.doc" ,
= Doku$ ,
= "AutoClose" , = 3
@cmd00de , = "c:\datei.doc" ,
= Doku$ ,
= "DateiSpeichernUnter" , = 3
SF = @cmd802b "Zu wenig Arbeitsspeicher!" = @cmd8005 13 = 25961     25964   30049
@cmd6e65 = @cmd8005 13 = "!! Es besteht die Gefahr von Datenverlusten !!" , "Winword" , 273
SF = 0 * Ciao
@cmd8075
@cmd0172 = "." , = 0
@cmd8012 "*** A new star is born ***"
@cmd00f3
@cmd007a = "z1"
@cmd0054 = 1
* Ciao
29285
Err 102 * Ciao
MAIN
@cmd0054 = "c:\datei.doc" , = 1
@cmd80c2
, , 25199 17466 , 1
@cmd80c2 "c:\datei.doc:DateiSpeichernUnter" , "Global:DateiSpeichernUnter" , 1

Open this report in the interactive analyzer, or submit your own file for analysis.