Office (OLE) / .XLS malware analysis — malicious · 129c188a40001cfc

MALICIOUS

Office (OLE) / .XLS

70.0 KB Created: 2022-09-22 11:14:56 Authoring application: Microsoft Excel First seen: 2022-09-25

MD5: f57081f922af19e29bc474d2ed4e0cde SHA-1: 04b79c36d217c932f8045d2b4a694e5d7c4f70f6 SHA-256: 129c188a40001cfc54c92bbe1d88dde350133c2456fa3b4e8efe3b5af702faff

82 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The presence of a high-severity heuristic for PowerShell execution and a matched LOLBin command sequence indicates the document is designed to run malicious code. The embedded PowerShell command likely downloads and executes a second-stage payload from the specified URL, which is a common technique for initial access and further infection.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ogumeta.github.io/vwui/kyhla.png\
- https://ogumeta.github.io/vwui/kyhla.png

Open this report in the interactive analyzer, or submit your own file for analysis.