Office (OLE) / .XLS malware analysis — malicious · 07bc756e9f681b73

MALICIOUS

Office (OLE) / .XLS

793.5 KB Created: 2021-07-15 12:50:47 Authoring application: Microsoft Excel

MD5: 694a89c43d506d56ce3cece6cf772c02 SHA-1: a0624d42ea889e4acc95795b5f00c4b053f2212c SHA-256: 07bc756e9f681b733754ccf7a3981e454be5e0a01da030e08aa039c2f4c18426

300 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1140 Deobfuscate/Decode Files or Information T1055.012 Process Injection: Process Hollowing T1547.001 Registry Run Keys / Startup Folder: Registry Run Keys / Startup Folder

The sample is an Excel file containing VBA macros that are triggered by Auto_Open and Document_Open. The macros use CreateObject("wScript.Shell") to write a base64-encoded payload to the user's AppData\Local\Microsoft\Windows\Apps directory, unzip it, and then execute it. Persistence is established by creating a registry Run key pointing to the extracted executable.

Heuristics 7

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION

VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
Document_Open macro high OLE_VBA_DOCOPEN

Document_Open macro
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `4dcebe827968903a33992315b7b73f2123987e627cb222f0c9be7a7a41957f4f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	363034 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.