Office (OLE) / .XLS malware analysis — malicious · 0ebe6a1378957d73

MALICIOUS

Office (OLE) / .XLS

71.0 KB Created: 2022-09-22 12:27:35 Authoring application: Microsoft Excel First seen: 2022-09-25

MD5: 9ffd8a3795e54e0d387e43a7f8ef966a SHA-1: d481e40a921df29cf6ece3716ac3be9b2599c376 SHA-256: 0ebe6a1378957d734cfda81aa7450d47f6d2df34748b46d51cd7320b3bfde4f7

82 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1218.011 System Binary Proxy Execution: Rundll32

The sample contains a high-confidence heuristic firing for PowerShell usage and a LOLBin execution sequence within the document text, specifically 'cmd/c powershell (new-object System.Net.WebClient).DownloadF'. This indicates an attempt to download and execute a second-stage payload. The embedded URLs, though marked as benign, are included as potential indicators.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ogumeta.github.io/vwui/kyhla.png\
- https://ogumeta.github.io/vwui/kyhla.png

Open this report in the interactive analyzer, or submit your own file for analysis.