Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 0ef8a0f9c5282625…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:30:24 Authoring application: Microsoft Excel First seen: 2021-06-28
MD5: f5fb497c1838784d11d9db48e435e840 SHA-1: a983850409df1f62be6dc607eb20a2abe606e1f8 SHA-256: 0ef8a0f9c5282625b5ba2bc98ae95d0239a4b03be33f3660c8ba1c358e4592e3
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically an Auto_Open defined name, which is a critical heuristic finding. This indicates that the macro sheet is designed to automatically execute code upon opening the workbook. The presence of dangerous formula APIs like RUN further confirms the malicious intent to execute arbitrary commands.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6539 bytes
SHA-256: 617983e8f19154eeb369106caf72cf0a135394c8ce72bea7a43311c2a0e41a62
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  klhoWea
' 0018     26 LABEL : Cell Value, String Constant - ARkZxDOlXvC len=0 
' 0018     22 LABEL : Cell Value, String Constant - AshXtJO len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!G132 
' 0018     24 LABEL : Cell Value, String Constant - CTJKOzvVM len=0 
' 0018     21 LABEL : Cell Value, String Constant - EZAZdQ len=0 
' 0018     23 LABEL : Cell Value, String Constant - hbrtokFt len=0 
' 0018     23 LABEL : Cell Value, String Constant - jsbRklqI len=0 
' 0018     23 LABEL : Cell Value, String Constant - KbiVCwev len=0 
' 0018     26 LABEL : Cell Value, String Constant - kTUIpjNArUb len=0 
' 0018     26 LABEL : Cell Value, String Constant - NFWdtEWXAgb len=0 
' 0018     21 LABEL : Cell Value, String Constant - NtQEKi len=0 
' 0018     24 LABEL : Cell Value, String Constant - nyTxQFbaX len=0 
' 0018     20 LABEL : Cell Value, String Constant - oPTYU len=0 
' 0018     26 LABEL : Cell Value, String Constant - QgMBEnLxBON len=0 
' 0018     26 LABEL : Cell Value, String Constant - qnVvGQTzeuz len=0 
' 0018     22 LABEL : Cell Value, String Constant - tquvsrg len=0 
' 0018     24 LABEL : Cell Value, String Constant - uogtCbgNR len=0 
' 0018     22 LABEL : Cell Value, String Constant - uONVHIG len=0 
' 0018     26 LABEL : Cell Value, String Constant - vofapuSMeLD len=0 
' 0018     27 LABEL : Cell Value, String Constant - vzrBWlxvjBMe len=0 
' 0018     27 LABEL : Cell Value, String Constant - xHeAoxXbzucA len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST

... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.