Simple Malicious Doc Analyst
Hi,

In October, we have received a strange file. This file is zipped with passwords. When we decompress file, TrendMicro engines is triggered and alerts that this is a strange file.

So I tried to inspect this file. First information:

File name: DAT 6021.doc SHA256 : FBA41FDD9A1E8B12844D2ED37A39199DBBC262040AF00488032CA8DD37D99AF8 SHA1:783A12021EB09E34B5E8C5670D9C3F475B420CA8

I tried to analyze with Virustotal and 38/64 engines detected this file as malicious.

I opened this document with OpenOffice. As show in this picture, it required users to enable macro to view the file content.

Digging deeper this file with oletool (oledump,olevba) by Mr. Didier Stevens.

So, 3 module macro were using on this malicious file

More analysis with Olevba, we got some evidence like :

This file is automatically executed when the file is opened

Showwindow is hidden,

VBA code is obfuscated.

CreateObject and Create

I tried to use option “— reveal” of olevba and exported to txt file.

The VBA string code is obfuscated. Then we more analyzed it further with Word VBA.
['Christ Young']
['Mti', 'Malware Analysis', 'Technology', 'Macro']