Malicious Office (OLE) — malware analysis report

Heuristics 18

• ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Win.Trojan.Pivis-2
• VBA macros detected medium 12 related findings OLE_VBA_MACROS
  Document contains VBA macro code
• Potential Shell call in VBA critical OLE_VBA_SHELL
  Potential Shell call in VBA
  Matched line in script

  Shell "regedit /s c:\Sadew.reg", vbHide

• WScript.Shell usage critical OLE_VBA_WSCRIPT
  WScript.Shell usage
  Matched line in script

  Set j8Q4v066K5R = CreateObject("WScript.Shell")

• Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
  Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
  Matched line in script

  Set WordObj = GetObject(, "Word.Application")

• VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
  VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
  Matched line in script

  dis.deletelines 1, dis.countoflines

• VBA email-worm self-replication (Outlook mass-mailer) critical OLE_VBA_EMAIL_WORM_SELF_REPLICATION
  VBA macro drives Outlook to mass-mail itself: it automates Outlook.Application, programmatically creates a mail item, and spreads by harvests recipients from the MAPI address book / inbox, sends the message programmatically. Harvesting recipients from the address book / inbox and auto-attaching the carrier to outgoing messages is the defining behavior of the Melissa / LoveLetter / W97M mass-mailer worm lineage — there is no benign document use, independent of any AV signature.
  Matched line in script

  Set P7A33U1L = AO534918.CreateItem(0)

• CreateObject call high OLE_VBA_CREATEOBJ
  CreateObject call
  Matched line in script

  Set WordObj = CreateObject("Word.Application")

• GetObject call high OLE_VBA_GETOBJ
  GetObject call
  Matched line in script

  Set WordObj = GetObject(, "Word.Application")

• VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
  The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
  Matched line in script

  book1Obj.SaveAs xlapp.Application.StartupPath & "\Book1.xls"

• VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
  Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
• AutoOpen macro low OLE_VBA_AUTOOPEN
  AutoOpen macro
  Matched line in script

  Sub AutoOpen()

• Document_Open macro low OLE_VBA_DOCOPEN
  Document_Open macro
  Matched line in script

  Private Sub Document_Open()

• Auto_Close macro low OLE_VBA_AUTOCLOSE
  Auto_Close macro
  Matched line in script

  Sub AutoClose()

• Reference to Windows Script Host high SC_STR_WSCRIPT
  Reference to Windows Script Host
• Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
  OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
• Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
  Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.virii.com.hr In document text (OLE body)

  • http://www.virii.com.hrTh�In document text (OLE body)

Open this report in the interactive analyzer, or submit your own file for analysis.