Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2730d73e09be7af7…

MALICIOUS

Office (OLE)

1001.5 KB Created: 2000-09-04 10:10:09 Authoring application: Microsoft Excel First seen: 2015-09-16
MD5: 32ea7cfd135b903617c25855d60f9da0 SHA-1: d2dd26ca1ff66597376c8de0fcacd03ff5579b2d SHA-256: 2730d73e09be7af7430e1ddb0077ee20b3d5b965739bd46370a48ee54eaf661c
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The file is identified as a malicious Excel document with a critical heuristic firing for a legacy Excel formula macro virus, specifically mentioning 'Poppy by VicodinES' and 'The Narkotic Network'. The embedded VBA macro, while not directly executing malicious code, contains strings and references indicative of this known malware family. The presence of 'Book1.xls' suggests an attempt to infect other workbooks.

Heuristics 2

  • Legacy Excel formula macro virus marker critical OLE_XLS_FORMULA_MACRO_VIRUS
    Workbook stream contains self-identifying legacy Excel formula macro virus markers. This indicates the document carries formula macro virus content even when no VBA project or modern XLM macro-sheet structure is present.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 13676 bytes
SHA-256: 4dbf310f202d8a71e009b6cad5a0398d762cb43b2b0d7d9e201fd19aedbe1fa7
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True




Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True



Attribute VB_Name = "Tinhtoan"
Option Explicit

Public Function Csi(N As Double, Rn As Double, Ra As Double, Fb As Double, Fa As Double)
Dim Csip As Double
Const Pi = 3.14159

    If N <= 0.77 * Rn * 10 ^ 3 * Fb + 0.645 * Ra * 10 ^ 3 * Fa Then
        Csi = 0
        Do
            Csip = Csi
            Csi = (N + Ra * 10 ^ 3 * Fa + Rn * 10 ^ 3 * Fb * Sin(2 * Pi * Csip) / (2 * Pi)) / (Rn * 10 ^ 3 * Fb + 2.55 * Ra * 10 ^ 3 * Fa)
        Loop Until Abs((Csi - Csip) / Csi) <= 0.01
    Else
        Csi = 0
        Do
            Csip = Csi
            Csi = (N + Rn * 10 ^ 3 * Fb * Sin(2 * Pi * Csip) / (2 * Pi)) / (Rn * 10 ^ 3 * Fb + Ra * 10 ^ 3 * Fa)
        Loop Until Abs((Csi - Csip) / Csi) <= 0.01
    End If

End Function

Public Function Can3(N As Double)
Dim Csip As Double
Dim a As Double, b As Double, c As Double, k As Double
    a = Sqr(N)
    b = Sqr(a)
    Do
        c = (a + b) / 2
        If c * c * c > N Then
            a = c
        Else
            b = c
        End If
        k = Abs(N - c * c * c) / N * 100
    Loop Until k <= 0.1
    Can3 = c
End Function

Public Function Noisuy(a1 As Double, a2 As Double, a As Double, g1 As Double, g2 As Double)
Noisuy = g1 + (g2 - g1) * (a - a1) / (a2 - a1)
End Function



Attribute VB_Name = "Tinhsan"
Sub TraHSM()
Dim sodo As String
sodo = Range("C5").Text
Select Case sodo
    Case "S¬ ®å 1"
        Range("C15").Formula = "=vlookup(C16,So_do_1,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_1,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_1,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_1,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_1,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_1,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_1,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_1,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_1,5)"
        
    Case "S¬ ®å 2"
        Range("C15").Formula = "=vlookup(C16,So_do_2,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_2,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_2,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_2,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_2,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_2,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_2,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_2,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_2,5)"
        
    Case "S¬ ®å 3"
        Range("C15").Formula = "=vlookup(C16,So_do_3,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_3,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_3,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_3,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_3,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_3,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_3,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_3,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_3,5)"
        
    Case "S¬ ®å 4"
        Range("C15").Formula = "=vlookup(C16,So_do_4,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_4,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_4,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_4,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_4,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_4,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_4,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_4,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_4,5)"
        
    Case "S¬ ®å 5"
        Range("C15").Formula = "=vlookup(C16,So_do_5,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_5,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_5,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_5,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_5,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_5,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_5,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_5,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_5,5)"
        
    Case "S¬ ®å 6"
        Range("C15").Formula = "=vlookup(C16,So_do_6,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_6,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_6,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_6,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_6,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_6,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_6,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_6,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_6,5)"
        
    Case "S¬ ®å 7"
        Range("C15").Formula = "=vlookup(C16,So_do_7,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_7,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_7,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_7,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_7,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_7,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_7,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_7,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_7,5)"
        
    Case "S¬ ®å 8"
        Range("C15").Formula = "=vlookup(C16,So_do_8,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_8,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_8,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_8,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_8,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_8,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_8,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_8,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_8,5)"
    
    Case "S¬ ®å 9"
        Range("C15").Formula = "=vlookup(C16,So_do_9,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_9,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_9,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_9,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_9,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.05)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_9,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_9,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_9,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_9,5)"
        
    Case "S¬ ®å 10"
        Range("C15").Formula = "=vlookup(C16,So_do_10,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_10,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_10,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_10,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_10,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.1)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_10,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_10,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_10,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_10,5)"

    Case "S¬ ®å 11"
        Range("C15").Formula = "=vlookup(C16,So_do_11,1)"
        Range("D15").Formula = "=VLOOKUP(C15,So_do_11,2)"
        Range("E15").Formula = "=VLOOKUP(C15,So_do_11,3)"
        Range("F15").Formula = "=VLOOKUP(C15,So_do_11,4)"
        Range("G15").Formula = "=VLOOKUP(C15,So_do_11,5)"
        
        Range("C17").Formula = "=ceiling(C16,0.1)"
        Range("D17").Formula = "=VLOOKUP(C17,So_do_11,2)"
        Range("E17").Formula = "=VLOOKUP(C17,So_do_11,3)"
        Range("F17").Formula = "=VLOOKUP(C17,So_do_11,4)"
        Range("G17").Formula = "=VLOOKUP(C17,So_do_11,5)"

End Select
End Sub

Function Kiemtra(a, a1, b, b1, c, c1, d, d1)
Kiemtra = "ThÐp sµn ®¶m b¶o kh¶ n¨ng chÞu lùc"
If a > 0 Then
    If a < a1 Then
        Kiemtra = "ThÐp sµn kh«ng ®ñ kh¶ n¨ng chÞu lùc"
    End If
End If

If b > 0 Then
    If b < b1 Then
        Kiemtra = "ThÐp sµn kh«ng ®ñ kh¶ n¨ng chÞu lùc"
    End If
End If

If c > 0 Then
    If c < c1 Then
        Kiemtra = "ThÐp sµn kh«ng ®ñ kh¶ n¨ng chÞu lùc"
    End If
End If

If d > 0 Then
    If d < d1 Then
        Kiemtra = "ThÐp sµn kh«ng ®ñ kh¶ n¨ng chÞu lùc"
    End If
End If

End Function



Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "cmdTramomen, 118, 0, MSForms, CommandButton"

Private Sub cmdTramomen_Click()
    TraHSM
End Sub

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet13"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "TCXDVN356"
Option Explicit

Public Function Tinhphi(M, Ml, N, eo, h, beta)
Dim phi As Double
Dim Phi1 As Double
Dim Mt As Double
If M * Ml > 0 Then
    phi = 1 + beta * Ml / M
    If phi > 1 + beta Then phi = 1 + beta
Else
    If Abs(eo) > 0.1 * h Then
        phi = 1
    Else
        Mt = N * h / 2
        Phi1 = 1 + beta * Ml / Mt
        phi = Phi1 + 10 * (1 - Phi1) * eo / h
    End If
End If
Tinhphi = phi
End Function

Public Function Ncr(Eb, Es, Ib, Ia, eo, h, lo, phi)
Ncr = 6.4 * Eb * 10 ^ 3 / lo ^ 2 * (Ib / phi * (0.11 / (0.1 + eo / h) + 0.1) + Es / Eb * Ia)
End Function

Public Function Xir(anfa, Rb, Rs)
Dim omega As Double
omega = anfa - 0.008 * Rb
Xir = omega / (1 + Rs / 500 * (1 - omega / 1.1))
End Function

Public Function Tinhx(muy, N, Rb, b, h, eo, ho, Rs, a, neta, Xir)
Dim x As Double
Dim Fa As Double
x = N / (Rb * 10 ^ 3 * b)   'LT lon
If x / ho > Xir Then    'LT be
    Fa = muy * b * h / 100 / 2
    x = (N + 2 * Rs * 10 ^ 3 * Fa * (1 / (1 - Xir) - 1)) / (Rb * 10 ^ 3 * b + 2 * Rs * 10 ^ 3 * Fa / (ho * (1 - Xir)))
End If
Tinhx = x
End Function

Public Function Tinhfa(muy, N, Rb, b, h, eo, ho, Rs, a, neta, Xir)
Dim x As Double
Dim e As Double
Dim Fa As Double
x = N / (Rb * 10 ^ 3 * b)
If x / ho <= Xir Then  'LT lon
    e = neta * eo + h / 2 - a
    Tinhfa = 10 ^ 4 * (N * e - Rb * 10 ^ 3 * b * x * (ho - 0.5 * x)) / (Rs * 10 ^ 3 * (ho - a))
Else
    Fa = muy * b * h / 100 / 2
    x = (N + 2 * Rs * 10 ^ 3 * Fa * (1 / (1 - Xir) - 1)) / (Rb * 10 ^ 3 * b + 2 * Rs * 10 ^ 3 * Fa / (ho * (1 - Xir)))
    e = neta * eo + h / 2 - a
    Tinhfa = 10 ^ 4 * (N * e - Rb * 10 ^ 3 * b * x * (ho - 0.5 * x)) / (Rs * 10 ^ 3 * (ho - a))
End If
End Function

Attribute VB_Name = "Sheet5"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "cmdTramomen, 3, 0, MSForms, CommandButton"

Private Sub cmdTramomen_Click()
    TraHSM
End Sub

Attribute VB_Name = "Sheet7"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "cmdTramomen, 3, 0, MSForms, CommandButton"

Private Sub cmdTramomen_Click()
    TraHSM
End Sub