MALICIOUS
240
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
This Excel 5 macro-based trojan, identified as Laroux-1, uses an Auto_Open macro to execute its payload. The script attempts to save a file named '1.XLS' in the startup path, which is a common technique for establishing persistence or delivering a second-stage payload. The presence of the 'laroux' sheet and the specific macro names strongly indicate this family.
Heuristics 5
-
Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUSLegacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
-
ClamAV: Xls.Trojan.Laroux-1 critical CLAMAV_DETECTIONClamAV detected this file as malware: Xls.Trojan.Laroux-1
-
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAVClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
-
Auto_Open macro high OLE_VBA_AUTOAuto_Open macro
-
VBA macros detected medium OLE_VBA_MACROSDocument contains VBA macro code
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas67081d657c6b9f0fa8681bb46691d9458b4648cb171fd66ca1d698afb194efbc |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 1831 bytes |
|
Detection
ClamAV:
Xls.Trojan.Laroux-1
Obfuscation or payload:
unlikely
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.