Xls.Trojan.Laroux-32 — Office (OLE) / .EXE malware analysis

Static analysis result for SHA-256 7989c2dcee063a8b…

MALICIOUS

Office (OLE) / .EXE

47.5 KB Created: 1980-01-04 07:43:21 Authoring application: Microsoft Excel
MD5: 1064d25d2971898ed0aaa53db4cf78a7 SHA-1: 5bb296f426fa19d4ed418e8cbbb8852589df7d8c SHA-256: 7989c2dcee063a8bd1ca95e80f4773a69b7633965c1d9433eb27abba951aa1fd
240 Risk Score

Malware Insights

Xls.Trojan.Laroux-32 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is identified as a variant of the Laroux macro virus, specifically Xls.Trojan.Laroux-32. It contains an Auto_Open macro that attempts to copy itself and save it as 'RESULTS.XLS' in the application startup path. This action is indicative of an attempt to establish persistence or act as a downloader for further malicious activity.

Heuristics 5

  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • ClamAV: Xls.Trojan.Laroux-32 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Laroux-32
  • ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV
    ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
d8b1b4c708fd41b97514706c0a5551bed87e9005c48552e401e8e0a7a8065d94		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 1907 bytes
Detection
ClamAV: Xls.Trojan.Laroux-32
Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.