Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 00eb5cd0eabd4fd5…

MALICIOUS

Office (OLE)

149.0 KB Created: 2016-02-02 08:34:00 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: 0658e5427d77225baff4f141546fe42b SHA-1: 010d7629298c8185d9722156638c3fb325c5aa95 SHA-256: 00eb5cd0eabd4fd5d9f9ba99581cd5bd15b9fcbba647134b9a5c77370bbfdf99
80 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The critical heuristic firing indicates the presence of an Excel 4.0 Auto_Open macro, which is designed to execute automatically when the workbook is opened. The macro sheet itself contains obfuscated strings and potentially malicious commands, though specific IOCs could not be fully extracted due to incomplete parsing.

Heuristics 2

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 90767 bytes
SHA-256: ec71e66da609134cf7f9de9f1daf185fdbabcf7b5dce4357a7d60e4ce22da540
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     15 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  WrwLSw
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d  Sheet!GW15536 
' 0018     31 LABEL : Cell Value, String Constant -       hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00\x82<\x1e=\xcd\x00\xcd\x00'
' 0018     28 LABEL : Cell Value, String Constant - hUnZKF hidden len=7 ptgRef3d  Sheet!GW15536 
' 0018     29 LABEL : Cell Value, String Constant -     hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00j<\xbb<\x92\x00\x92\x00'
' 0018     31 LABEL : Cell Value, String Constant -           hidden len=7 ptgRef3d  Sheet!GW15538 
' 0018     30 LABEL : Cell Value, String Constant -          hidden len=7 ptgRef3d  Sheet!GW15540 
' 0018     30 LABEL : Cell Value, String Constant -          hidden len=7 ptgRef3d  Sheet!GW15542 
' 0018     30 LABEL : Cell Value, String Constant -      hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00"<\x81<\xa5\x00\xa5\x00'
' 0018     31 LABEL : Cell Value, String Constant -       hidden len=11 ptgArea3d  *INCOMPLETE FORMULA PARSING* Remaining, unparsed expression: b'\x00\x00^<\xd9<\xc7\x00\xc7\x00'
' 0018     32 LABEL : Cell Value, String Constant -            hidden len=7 ptgRef3d  Sheet!GW15541 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, Strin
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.