Office (OLE) / .XLS malware analysis — malicious · 089cfc377781c377

MALICIOUS

Office (OLE) / .XLS

68.0 KB Created: 2022-06-29 09:32:33 First seen: 2022-06-30

MD5: 71777b9c767064f64557c375b70b0647 SHA-1: f1f6029b95ed10d2e405abb434948a7937c4c723 SHA-256: 089cfc377781c37785ce808c45e458957f2837cc3d526366d7679d0a6fa2fc19

188 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The XLS file contains VBA macros that utilize the URLDownloadToFileA API to download a payload from the domain 'dhlpro.com'. The script then attempts to execute the downloaded file, indicating a downloader or droppper functionality. The obfuscated nature of the script and the use of a URL for payload delivery suggest a typical malicious macro attack.

Heuristics 5

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `4eb2c729545a6d2d9a79eab97153b3472684739a6674d2d24df2964823b86b5f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2221 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.