Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 101c7bafc0dc6e45…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:44:48 Authoring application: Microsoft Excel First seen: 2021-06-28
MD5: 86beba191bd27ac0f0805f14b68d793a SHA-1: e38935224ac728eca21ca1e99889a0fe3d8b2456 SHA-256: 101c7bafc0dc6e45f2823f2dc6a172f1ef8518c482ddeecd06f421aa23592c6b
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an Excel file containing Excel 4.0 (XLM) macros. Critical heuristics indicate the presence of an Auto_Open defined name and the use of dangerous formula APIs, specifically the RUN function. This strongly suggests the macro is designed to execute arbitrary code upon opening the document, likely to download and run a secondary payload.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6711 bytes
SHA-256: 0dfa0461680dd28920feb18fccf602d9f3fe7e7af244a77cb51d83ba50ba4f41
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  WlEJguD
' 0018     21 LABEL : Cell Value, String Constant - acODtB len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!F145 
' 0018     23 LABEL : Cell Value, String Constant - cOdEsyil len=0 
' 0018     25 LABEL : Cell Value, String Constant - cRxkbcHyHD len=0 
' 0018     25 LABEL : Cell Value, String Constant - CZUreRdXtP len=0 
' 0018     22 LABEL : Cell Value, String Constant - GunrmBO len=0 
' 0018     23 LABEL : Cell Value, String Constant - GuTINmVr len=0 
' 0018     21 LABEL : Cell Value, String Constant - HLoWWA len=0 
' 0018     20 LABEL : Cell Value, String Constant - HppWK len=0 
' 0018     27 LABEL : Cell Value, String Constant - JRUvKkgzmtjM len=0 
' 0018     24 LABEL : Cell Value, String Constant - kRwrIzcZk len=0 
' 0018     24 LABEL : Cell Value, String Constant - LdOjZnxvY len=0 
' 0018     23 LABEL : Cell Value, String Constant - nEfIuKAc len=0 
' 0018     20 LABEL : Cell Value, String Constant - ReBIH len=0 
' 0018     21 LABEL : Cell Value, String Constant - wTNoha len=0 
' 0018     21 LABEL : Cell Value, String Constant - xoQhfH len=0 
' 0018     20 LABEL : Cell Value, String Constant - XZTNa len=0 
' 0018     24 LABEL : Cell Value, String Constant - YSikIYjcl len=0 
' 0018     23 LABEL : Cell Value, String Constant - ZFyCwKCa len=0 
' 0018     22 LABEL : Cell Value, String Constant - ZtCbeZz len=0 
' 0018     22 LABEL : Cell Value, String Constant - zxLqxRh len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cel
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.