Virus.MSWord.Outlaw

Parent class: VirWare

Viruses and worms are malicious programs that self-replicate on computers or via computer networks without the user being aware; each subsequent copy of such malicious programs is also able to self-replicate. Malicious programs which spread via networks or infect remote machines when commanded to do so by the “owner” (e.g. Backdoors) or programs that create multiple copies that are unable to self-replicate are not part of the Viruses and Worms subclass. The main characteristic used to determine whether or not a program is classified as a separate behaviour within the Viruses and Worms subclass is how the program propagates (i.e. how the malicious program spreads copies of itself via local or network resources.) Most known worms are spread as files sent as email attachments, via a link to a web or FTP resource, via a link sent in an ICQ or IRC message, via P2P file sharing networks etc. Some worms spread as network packets; these directly penetrate the computer memory, and the worm code is then activated. Worms use the following techniques to penetrate remote computers and launch copies of themselves: social engineering (for example, an email message suggesting the user opens an attached file), exploiting network configuration errors (such as copying to a fully accessible disk), and exploiting loopholes in operating system and application security. Viruses can be divided in accordance with the method used to infect a computer:

• file viruses
• boot sector viruses
• macro viruses
• script viruses

Any program within this subclass can have additional Trojan functions. It should also be noted that many worms use more than one method in order to spread copies via networks.

Class: Virus

Viruses replicate on the resources of the local machine. Unlike worms, viruses do not use network services to propagate or penetrate other computers. A copy of a virus will reach remote computers only if the infected object is, for some reason unrelated to the virus function, activated on another computer. For example: when infecting accessible disks, a virus penetrates a file located on a network resource a virus copies itself to a removable storage device or infects a file on a removable device a user sends an email with an infected attachment.

Read more

Platform: MSWord

Microsoft Word (MS Word) is a popular word processor and part of Microsoft Office. Microsoft Word files have a .doc or .docx extension.

Description

Technical Details

These are semi-polymorphic macro viruses - while infecting a file they copy their three macros with random selected names, so there are no fixed set for macros' names in infected files and NORMAL.DOT.

To realize this semi-polymorphism the virus uses system random counter and timer - while selecting new name for macro the virus sets the first letter in name depending on current hour: 1 - 'A', 2 - 'B', 3 - 'C' and so on, and then appends four random selected digits. As a result random selected names look like: O8493, O7920, O9259, or M8064, M8908, M8151.

Other version of this virus may use other schemes to build the names, "Outlaw.Goodbye" also starts the macro names according to current hour, but uses other set of letters: 1 - 'AZ', 2 - 'BY', 3 - 'CX', and so on.

There are no auto-macros in virus, and to get control the virus assigns its macros with keystrokes: SPACE key - macros that infects global macros area, 'E' key - macros that infects current document.

To get the name of current macro while copying it and to run its payload macro the virus uses two ways. To get its names from a document the virus creates three variables in document: VirNameDoc, VirName, VirNamePayload, and saves there current names while infecting. In case of need the virus gets these names from there.

To get the names in case of NORMAL.DOT (global macros area) the virus creates three records containing current names in System Profile (WIN.INI file) in [Intl] section, these strings are:

[Intl]
Name=
Name2=
Name3=

On January 20 original "Outlaw" virus runs its trigger routine. Under Windows95 and depending on several other conditions the virus plays a sound - it drops LAUGH.WAV file and plays it (this file contains recorded laugh). The virus also inserts in current document the strings:

You are infected with
Outlaw
A virus from Nightmare Joker

There is an encrypted variant of original "Outlaw" - the "Outlaw.b" virus.

"Outlaw.Black" contains two macros with 8-letters random names (for example - DIJRCJCY, DOFYBPIT). This virus displays the message box:

BlackKnight

"Outlaw.Goodbye" is encrypted, plus to three random-named macros it contains two "stealth" macros - ToolsMacro and ExtrasMakro. While selecting Tools/Macro menu the virus shows "dummy" menus and displays error messages in the same way the Magnum virus does.

On October 10 this virus drops and runs "VLAD.Goodbye" DOS virus, creates new template and writes the text to there:

You are infected with the MooNRaiDer Virus!
Greetings to all members of Vlad!
I hope that's not the end!
The scene would be to boring without this very good group!
Nightmare Joker

This virus then creates SystemProfile section (WIN.INI file):

[Vlad]
Goodbye=Yes

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com