Office (OLE) / .XLS malware analysis — malicious · 087dcbea5721bd14

MALICIOUS

Office (OLE) / .XLS

101.0 KB Created: 2025-06-03 08:13:21 Authoring application: Microsoft Excel

MD5: ae4c39b1e3b93cb2f7f24755851ef1c9 SHA-1: cfbfa9e2c1006f8f0791274c07cfb316e502fd45 SHA-256: 087dcbea5721bd149315f56d76a454878c12428b0b76824c69296f70deba3712

440 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1204.002 Malicious File

The file contains heavily obfuscated VBA macros, including an Auto_Open function that utilizes CreateObject and Shell calls. The script attempts to reassemble the string 'Scripting.FileSystemObject' and writes to a path derived from 'Application.UserLibraryPath', indicating an intent to download and execute a secondary payload. The presence of heap spray and NOP sled heuristics further suggests exploitation or shellcode execution.

Heuristics 10

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Dangerous API name reassembled from split string literals critical OLE_VBA_SPLIT_KEYWORD_OBFUSCATION

VBA concatenates short string literals that reassemble a dangerous API/ProgID/LOLBin name (e.g. Scripting.FileSystemObject, WScript.Shell, powershell, URLDownloadToFile) which appears in no single literal. Splitting an API name across string concatenation is done only to evade keyword scanning.
ClamAV: Xls.Malware.Valyria-6995973-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Valyria-6995973-0
Heap-spray pattern detected high SC_HEAP_SPRAY

Repeated 0x41 (A) bytes found
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED

Long run of 0x41 bytes
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `8b2f6051777c5d4ca3641dd8bf0d42fcea0d8d5d465f79786b0180b613b33a68`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2618 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.