Office (OLE) / .XLS malware analysis — malicious · 08beeade6d52ae0a

MALICIOUS

Office (OLE) / .XLS

293.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel First seen: 2023-05-17

MD5: 1c71554ef8cc55e0de04e3ca361966c4 SHA-1: 67459be6aab6951b2c7e8888d61c3a0a87c24097 SHA-256: 08beeade6d52ae0aa49ff63c946e0b6ab5f3ec1c5d4d1e68d085e1aae572ca90

70 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1059.005 Visual Basic

The critical heuristic firing indicates exploitation of CVE-2017-0199 via an OLE2Link object, which attempts to download a secondary document from the embedded URL http://195.201.147.116/f/ASSS%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23sss.doc. Although no executable VBA code was found, the presence of the OLE2Link object and the embedded URL strongly suggest a downloader or initial access mechanism. The VBA project itself is minimal and does not contain executable statements, but the exploit relies on the OLE object's functionality.

Heuristics 3

OLE2Link / URL Moniker → remote loader — CVE-2017-0199 critical CVE likely CVE_2017_0199

Document contains an embedded OLE link object whose URL Moniker points to a remote URL. When the host file is opened, Office follows the link, downloads the URL, and processes the response based on its Content-Type (HTA -> mshta.exe, RTF → Word, etc.) — the documented CVE-2017-0199 primitive. The URL extension is not a reliable filter; servers can return different payloads to Office's user agent.
VBA project contains no executable statements low OLE_VBA_MACROS

Document contains a VBA project, but extracted modules only contain attributes/options/comments and no executable statements.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://195.201.147.116/f/ASSS%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23sss.doc

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7f506327609c082af1cd37dde23bc2c71a000f7d1ef530b6abb66775040a7673`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1206 bytes
`font_00_sfnt_off00002f55.bin` `c770f9918a4512e864d5cb442b6b813020a99b29f560e058e4362ddfc8412387`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2F55	11884 bytes
`font_01_sfnt_off00004cc4.bin` `dd457e884a659b63f960fd1c1b3ba45b073ca5832921ee06c6cae7a7d12bd11f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4CC4	15280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.