Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1469ca80a55b8192…

MALICIOUS

Office (OLE)

111.5 KB Created: 2020-07-08 07:27:00 Authoring application: Microsoft Excel First seen: 2020-09-07
MD5: 53d2f0ddff2b39c095304eeb5734f36b SHA-1: 4dab7981b368cd19ef6254a02465721bef39ac8a SHA-256: 1469ca80a55b8192ebcdd0d18eb91610028a117b6437bc296ce42788adfc05e9
200 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically an Auto_Open function, which is a known technique for executing malicious code upon opening the document. The heuristics indicate the use of dangerous formula APIs and environment evasion, suggesting the macro is designed to download and execute a secondary payload. The presence of an Auto_Open entry strongly implies this file was intended to be delivered as a malicious attachment.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • XLM Auto_Open environment-evasion close gate critical OLE_XLM_ENVIRONMENT_EVASION_CLOSE
    Excel 4.0 macro sheet auto-executes environment checks with GET.WORKSPACE / GET.WINDOW, then shows a fake corruption/error message and closes the workbook when the host fails those checks. This is a malware sandbox-evasion pattern, even when the later payload stage is hidden behind obfuscated defined-name flow.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 60086 bytes
SHA-256: 8e1bf3f553d4c492732f6de446f4fe433ea4e80a4101358960379518a4b809c5
Preview script
First 1,000 lines of the extracted script
' 0085      9 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  
' 0085     17 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden -  zwTDOTQb
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, hidden -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0018     22 LABEL : Cell Value, String Constant - aehYxNG len=0 
' 0018     50 LABEL : Cell Value, String Constant - afndJRSQVszHkxwNRULkzscKNhKOcYHVuuV len=0 
' 0018     52 LABEL : Cell Value, String Constant - aqtwoNcVFnpKmrFPkxlXyVUvdugkLlwqJGcxW len=0 
' 0018     34 LABEL : Cell Value, String Constant - aQvqrpufmtKkkzqskKm len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  !IE54488 
' 0018     43 LABEL : Cell Value, String Constant - BbmgyvSoNFBNesOCLidHJpKPXNsC len=0 
' 0018     53 LABEL : Cell Value, String Constant - bmETablJEhjPWpwmSNOMRDJQhIHXNQIgJomUJd len=0 
' 0018     49 LABEL : Cell Value, String Constant - bmVUItVrESzRDHhVTNfcyVtyvHKZuvFPKn len=0 
' 0018     22 LABEL : Cell Value, String Constant - BxsKIeO len=0 
' 0018     35 LABEL : Cell Value, String Constant - cHiTjnphHjOyuiDtkyJr len=0 
' 0018     21 LABEL : Cell Value, String Constant - CmfmRe len=0 
' 0018     20 LABEL : Cell Value, String Constant - cMtwR len=0 
' 0018     63 LABEL : Cell Value, String Constant - CMuuhUuResZrdhHvsmFCYuTZVgjyUVfojNdvQjdTyHIGLwpw len=0 
' 0018     21 LABEL : Cell Value, String Constant - CxlHwn len=0 
' 0018     25 LABEL : Cell Value, String Constant - cyisyuHXYt len=0 
' 0018     38 LABEL : Cell Value, String Constant - CzFcjqVhhwBEvUjcMtwRtxM len=0 
' 0018     21 LABEL : Cell Value, String Constant - DgwdjD len=0 
' 0018     39 LABEL : Cell Value, String Constant - dgXwZFCkYtjaoyhhUUvERsNr len=0 
' 0018     24 LABEL : Cell Value, String Constant - DirrqvSZg len=0 
' 0018     26 LABEL : Cell Value, String Constant - DJFQhiEFPmT len=0 
' 0018     21 LABEL : Cell Value, String Constant - dqeQrO len=0 
' 0018     24 LABEL : Cell Value, String Constant - dTytusxip len=0 
' 0018     18 LABEL : Cell Value, String Constant - dUh len=0 
' 0018     39 LABEL : Cell Value, String Constant - DWpJEsYhiglWPXBONdhjbBQI len=0 
' 0018     23 LABEL : Cell Value, String Constant - eEgLvrfB len=0 
' 0018     24 LABEL : Cell Value, String Constant - EfCBcKbNR len=0 
' 0018     57 LABEL : Cell Value, String Constant - EfnBcvbzRrRcWoYuepvrDUiqrCZUxyfmFNDidechSZ len=0 
' 0018     22 LABEL : Cell Value, String Constant - efpytXm len=0 
' 0018     50 LABEL : Cell Value, String Constant - EGaDIVfBOCnPlkMtLwBbBMGYWsOmfbmESnb len=0 
' 0018     56 LABEL : Cell Value, String Constant - EgkyuerRRsBNpJoMeEepjClIrDIFQhvEFOmgKMsyS len=0 
' 0018     22 LABEL : Cell Value, String Constant - enMsWlS len=0 
' 0018     61 LABEL : Cell Value, String Constant - eqTmSpIhITNfPlVflhtLZhirPKnpWcvEtZUVTYJQXnOOdT len=0 
' 0018     22 LABEL : Cell Value, String Constant - ETmHZUJ len=0 
' 0018     22 LABEL : Cell Value, String Constant - EUuuKBD len=0 
' 0018     28 LABEL : Cell Value, String Constant - FaclvqTjCWpjZ len=0 
' 0018     22 LABEL : Cell Value, String Constant - FdjfqtJ len=0 
' 0018     54 LABEL : Cell Value, String Constant - FFEJfmtYlkBEHyXmfPwzUwBPMuIhhJRdGZFduUu len=0 
' 0018     51 LABEL : Cell Value, String Constant - fnoyWRuvcjCKzfabZePWdtVUkadUtWCyhVqg len=0 
' 0018     55 LABEL : Cell Value, String Constant - FOONSDvDhutKNQIgvoYHJdGLYiERFqSonPwOzEeE len=0 
' 0018     59 LABEL : Cell Value, String Constant - FpipUhgwBDuUjbMtvQsxLWqErdFbaCjBnrRrDwPMiFdV len=0 
' 0018     52 LABEL : Cell Value, String Constant - fqtJefoytXmGZsncIRSQVGyGkxwNRTLkzrcKM len=0 
' 0018     53 LABEL : Cell Value, St
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.