Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 15cfef3e5b8fe09f…

MALICIOUS

Office (OLE) / .XLSX

33.0 KB Created: 2021-01-27 08:42:45 Authoring application: Microsoft Excel First seen: 2022-04-13
MD5: aa98958ea67bb0c6ff48af84e07408c7 SHA-1: d7aa4df7efe9ac8355da24dc79791b07e2a35686 SHA-256: 15cfef3e5b8fe09f7d456d1a3e3ba763ba5976ae643ddb6b9bcb4b1764dab4f7
180 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains an Excel 4.0 macro sheet with an Auto_Open defined name, indicating automatic execution upon opening. The presence of WinExec API references and dangerous formula APIs suggests the macro is designed to run an external command or payload. No specific family could be identified, but the technique points to a downloader or initial execution vector.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Reference to WinExec API high SC_STR_WINEXEC
    Reference to WinExec API
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
80069ea8e52eda2df02bdbbb56428b9306cf27342123611014430a37bc03b060		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 3108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.