Office (OLE) / .XLS malware analysis — malicious · 02c0287ef7e582ab

MALICIOUS

Office (OLE) / .XLS

105.0 KB Created: 2023-02-16 07:32:17 Authoring application: Microsoft Excel First seen: 2023-02-16

MD5: 2d7c714f9ed93712aaa2c528ad500a01 SHA-1: ed6776d341d2a02cda3c7bf444610aee2b0e2913 SHA-256: 02c0287ef7e582ab40149de264782b6e6d8aaa853aaf773b25749fa41e056a2b

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1059 Command and Scripting Interpreter

The sample is a malicious Excel file containing VBA macros. The macros utilize the URLDownloadToFileA API to download a second-stage payload from a remote source. The Shell() and CreateObject() calls further indicate the execution of downloaded or embedded code, suggesting a downloader or droppper functionality.

Heuristics 6

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0cb9d1a5a9c38939e053c21691e24700ebfb79fb3217634b05b337ca66bcaa70`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2246 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.