Xls.Dropper.Agent-8851317-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 00e82dd014370c9d…

MALICIOUS

Office (OLE)

1.12 MB Created: 2020-07-08 17:51:14 Authoring application: Microsoft Excel First seen: 2020-09-15
MD5: 268efe92a6e16c89e62bf0c32113d0c9 SHA-1: d42d766a18fc56170ff2978a2bf07bd9cafac3e8 SHA-256: 00e82dd014370c9db5a95fd0fd3a5438e4a51f4d64a15ddffaa77f2e806d2a74
222 Risk Score

Malware Insights

Xls.Dropper.Agent-8851317-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is identified as malicious by ClamAV with the signature Xls.Dropper.Agent-8851317-0. It contains VBA macros, specifically an Auto_Open macro that utilizes the Shell() function. This indicates the macro is designed to execute an external command, a common technique for downloading and executing further malicious content. The embedded VBA macro file 'macros.bas' is the primary artifact.

Heuristics 6

  • ClamAV: Xls.Dropper.Agent-8851317-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-8851317-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Auto_Open macro high OLE_VBA_AUTO
    Auto_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 7638 bytes
SHA-256: b47914b85cb6eb854bbc923d2505af5ebbe984714bb1a7f775223c73615c3989
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "btnPredict, 3, 0, MSForms, CommandButton"
Attribute VB_Control = "TextBox1, 4, 1, MSForms, TextBox"
Attribute VB_Control = "TextBox2, 5, 2, MSForms, TextBox"
Attribute VB_Control = "TextBox3, 6, 3, MSForms, TextBox"
Sub btnPredict_Click()
    Dim i, j, k As Long
    Dim ca, cb, cc, ce
    Dim cd(11)
    ca = Array("world", "asia", "europe", "america", "africa", "ocean")
    cb = Array("case", "death")
    cc = Array(13, 16, 19, 22, 25, 28)
    cd(0) = Int(WorksheetFunction.Sum(Worksheets("world_case").Range("B2:B191")))
    cd(1) = Int(WorksheetFunction.Sum(Worksheets("world_death").Range("B2:B191")))
    cd(2) = Int(WorksheetFunction.Sum(Worksheets("asia_case").Range("B2:B191")))
    cd(3) = Int(WorksheetFunction.Sum(Worksheets("asia_death").Range("B2:B191")))
    cd(4) = Int(WorksheetFunction.Sum(Worksheets("europe_case").Range("B2:B191")))
    cd(5) = Int(WorksheetFunction.Sum(Worksheets("europe_death").Range("B2:B191")))
    cd(6) = Int(WorksheetFunction.Sum(Worksheets("america_case").Range("B2:B191")))
    cd(7) = Int(WorksheetFunction.Sum(Worksheets("america_death").Range("B2:B191")))
    cd(8) = Int(WorksheetFunction.Sum(Worksheets("africa_case").Range("B2:B191")))
    cd(9) = Int(WorksheetFunction.Sum(Worksheets("africa_death").Range("B2:B191")))
    cd(10) = Int(WorksheetFunction.Sum(Worksheets("ocean_case").Range("B2:B191")))
    cd(11) = Int(WorksheetFunction.Sum(Worksheets("ocean_death").Range("B2:B191")))
    ce = Array("P", "R")
    seldate = TextBox2 + "/" + TextBox3 + "/" + TextBox1
    
    For j = 0 To 5
        For k = 0 To 1
            With Worksheets(ca(j) + "_" + cb(k))
                For i = 192 To 732
                    cd(j * 2 + k) = cd(j * 2 + k) + Int(.Cells(i, "C"))
                    If Str(.Cells(i, "A")) = seldate Then
                         Cells(cc(j), ce(k)) = Int(.Cells(i, "C"))
                         Exit For
                    End If
                Next
                Cells(cc(j) + 1, ce(k)) = cd(j * 2 + k)
            End With
        Next
    Next
End Sub

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet4"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet5"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Sheet6"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_Predecla
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.