Office (OLE) / .XLS malware analysis — malicious · 0005144ebb03d2f5

MALICIOUS

Office (OLE) / .XLS

33.0 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-10-12

MD5: 92f95e7159ae2b822b18b97ad25b9229 SHA-1: 86eb42a1f6b7ea3730accdab11ca515ffb524dd3 SHA-256: 0005144ebb03d2f5a5b17e21362c628ddc1705e910cfd56032b7b55c932b68da

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.005 Visual Basic

The VBA macro contains obfuscated PowerShell code that attempts to download a JavaScript file from 'http://fc.enairihsab.com/pw-folders/ms/protected-Client/js/notepad.js' and save it as 'notepad.js' in the temporary directory. The script then executes this downloaded JavaScript file. The PowerShell reference and CreateObject call indicate a malicious intent to execute downloaded code.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `676db054e122432ad7dee2280cb5c1a5e3a77fdad2354ec831d114d0f66996da`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1493 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.