W97M

Threat description

Details

CATEGORYMalware
TYPEVirus, Trojan, Trojan-Downloader

Summary

W97M is F-Secure's platform designation for malware spread in specially crafted Microsoft Office Word documents (version Word 97 and onwards).

Removal

Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Vulnerability Protection

The vulnerability (or vulnerabilities) leveraged by the specially crafted document file are usually application- or platform-specific; a particular program (or even a specific version of the program) must be installed on the machine in order for the exploit to be effective.

To prevent exploitation of such vulnerabilities, please refer to the application vendor for the latest updates and additional advice.

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:

Technical Details

The Microsoft Office productivity software suite is one of the most commonly found set of programs on computers around in the world, on both business and personal computers. The suite includes the Word, Excel, Powerpoint, Outlook, OneNote and Access programs, as well as other less commonly used software.

Exploiting the user's trust

Because Microsoft Office is so commonly used, most computer users are familiar with it and generally trust files associated with its programs. Attackers thus try to exploit the implicit trust and familiarity users have with such files by secretly embedding malware into document files and distributing them, either en mass or to targeted users.

These 'bait' files are often specifically designed, or 'socially engineered', to look legitimate. For example, they may use filenames such as 'resume.doc' or 'invoice.docx', and contain content (sometimes stolen from actual legitimate documents) that seem authentic. The careful crafting of the bait files is meant to encourage the user to believe the document is trustworthy and open the file - and in so doing, unsuspectingly run the malware.

Macros, downloaders and droppers

Some W97M malware exploit vulnerabilities in the Microsoft Word program itself to execute code on the user's computer, though this is relatively less common, since it requires more technical skill to accomplish. Other W97M malware are independent programs that only use the Word document as a 'carrrier', and once run they can operate separately. One example of this type of malware is Trojan:W97M/Streedom.A.

The most common type of W97M malware however is a malicious macro embedded into the Word document itself. A macro is a tiny program that can be legitimately used in Word to automate some functions, but an attacker can also craft a macro to perform malicious actions. Most often, these malicious macros are used by attackers to download additional malware onto the user's computer. Some representative examples of macro malware in Word documents are:

Note

With changes in the threat landscape today, F-Secure has updated its platform designation convention and malware affecting this platform now uses the platform designation, 'WM'.

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info