VBA macro-virus self-replication / AV tampering

OLE_VBA_MACRO_VIRUS_REPLICATION

← All detection heuristics · Office

critical OLE_VBA_MACRO_VIRUS_REPLICATION

What it means

VBA macro rewrites VBA project code (self-replication) and/or disables Office macro-virus protection.

Why it fires

The macro programmatically edits VBA project code through the VBE object model — CodeModule/VBComponents/VBProject with InsertLines, DeleteLines, AddFromString, or OrganizerCopy — to copy itself into the global template (Normal.dot) and other open documents, and/or sets Options.VirusProtection = False to silence Word's macro-virus warning. Self-replicating macro code has no benign document use; this is the defining behavior of the W97M macro-virus family (Thus, Melissa, Class, Marker), detected independently of any AV signature. Writes that target only the running document are self-modification, not replication, and are reported as OLE_VBA_SELF_MODIFYING_PROJECT instead.

Other Office heuristics

OLE_VBA_AFFINE_MSI_DOWNLOADER OLE_VBA_AUTOEXEC_FRAGMENTED_SHELL OLE_VBA_DESTRUCTIVE_WORKBOOK_SHUTDOWN OLE_VBA_BIDIRECTIONAL_MACROCOPY_REPLICATION OOXML_BRAND_LINK_MISMATCH_LURE CVE_2016_7262 POLYGLOT_OOXML_REL_COMMAND OLE_RAW_PCODE_CROSS_DOCUMENT_REPLICATION OLE_VBA_CROSS_WORKBOOK_REPLICATION OOXML_XLM_DANGEROUS_FN OFFICE_DEFAULT_PASSWORD_VBA_DROP_EXEC OFFICE_EMBEDDED_SWF EMBEDDED_OFFICE_CHILD_STATIC_TRIAGE OFFICE_EMBEDDED_MACRO_OBJECT OLE_EMBEDDED_EXE OLE_VBA_EMBEDDED_PE_DROPPER OLE_ENCRYPTED_AND_MALFORMED CVE_2017_11882_EQUATION_NATIVE_CMD_RELATED CVE_2017_11882 OLE_EQUATION_OLE10NATIVE_DOWNLOADER OLE_MTEF_NATIVE_CODE_STUB OLE_EQUATION_OLE10NATIVE_SHELLCODE OOXML_XLM_MACRO_IN_WORKSHEET OLE_XLS5_LAROUX_MACRO_VIRUS