Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b52f66ef5f2f96d4…

MALICIOUS

Office (OLE)

767.0 KB Created: 1999-03-22 14:02:07 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: 6573dd00ee3812d7f039fe3973cd0b95 SHA-1: 6629495da37ae08a2c93f5028a73f41691214b10 SHA-256: b52f66ef5f2f96d4babcc839759fcbc8622a1f3dd7a9c38768c273ce934df28b
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.005 Visual Basic

The file is identified as a malicious Excel 5 macro virus (Laroux/Larou-CV) by multiple heuristics, including ClamAV detection as 'Xls.Trojan.Jin-1'. The document body mimics a Korean tax form, suggesting a social engineering lure to encourage macro execution. No specific script content was extracted, but the presence of the 'laroux' marker and 'auto_open' function strongly indicates macro execution for malicious purposes.

Heuristics 3

  • ClamAV: Xls.Trojan.Jin-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Jin-1
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • VBA project contains no executable statements low OLE_VBA_MACROS
    Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 838 bytes
SHA-256: cf076f1bbf22b256ce232bce4adf0e0e9971882618cfa67ee80cc6985d159a6e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True


Attribute VB_Name = "Module1"

Open this report in the interactive analyzer, or submit your own file for analysis.