Malicious Office (OLE) / .XLSX — malware analysis report

Static analysis result for SHA-256 190045bc473705e5…

MALICIOUS

Office (OLE) / .XLSX

472.0 KB Created: 2021-05-25 13:14:36 Authoring application: Microsoft Excel
MD5: f32e26c6ae13dac45097c72b8c8249f5 SHA-1: 26137ecb3e2d8d6c155677f943ef221e55e03204 SHA-256: 190045bc473705e57a09727730e1d7f0d7a789980f1eb0de77e230248c54cb1a
350 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1105 Ingress Tool Transfer T1204.002 Malicious File

The sample contains VBA macros that execute upon opening the workbook, leveraging WScript.Shell to download and execute a payload from a remote URL. The Workbook_Open macro is designed to trigger this malicious behavior, indicating a downloader or droppper functionality. The presence of WScript.Shell and CreateObject calls, along with the HTTP download and execution heuristic, strongly suggests this pattern.

Heuristics 10

  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
  • VBA downloads and writes a file to disk critical OLE_VBA_HTTP_DROP_EXEC
    VBA reads an HTTP response body and writes it to disk (ADODB.Stream SaveToFile). Combined with the auto-exec/Shell paths this is a download-drop dropper even when the COM ProgIDs are built dynamically to evade keyword scanning.
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • OLE file has appended executable-looking payload bytes high OLE_APPENDED_PAYLOAD
    OLE compound file contains a large high-entropy region beyond the declared major streams and that region includes shellcode, PE, or loader API markers. This is a payload-carrier signal, not a specific CVE attribution by itself.
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kriegeradvogados.com.br/bck/old/novo/xmlrpc/cache/ManXtMQc.php
    • https://firstcanadianmedical.ca/wp-admin/2thsRO3R.php
    • https://firstcanadianmedical.ca/wp-admin/2thsRO3R.phpF
    • https://www.carnivalspadubai.coAh�����{,X�r
    • https://app6.salesdatagenerator.com/wp-content/plugins/wp-all-import-pro/classes/PHPExc�
    • https://landingpages.pontodata.com.br/wp-content/plugins/duracelltomi-google-tag-manager/integr
    • https://afemnor.es/wp-content/themes/dt-the7/inc/mods/compatibility/elementor/pro/modules/query-contol/FHo2N5GW1hAjyYV.php
    • https://661partyrentals.com/wp-content/plugins/ultimate-member/templates/email/UhUsapvuN2huM.phpR30gkR30gkR30gkR30gkR30gk
    • https://ottomanbilisim.com/include/modules/projeler/main/kat/J5EhdxpwdN8O
    • https://www.carnivalspadubai.com/images/ladies/6s6wTH17bXA.phpKjnO,wITVWor9
    • https://app6.salesdatagenerator.com/wp-content/plugins/wp-all-import-pro/classes/PHPExcel/D09Po1Rg.php
    • https://landingpages.pontodata.com.br/wp-content/plugins/duracelltomi-google-tag-manager/integration/whichbrowser/src/Analyser/Header/Useragent/Device/NPIMchMQuv.php
    • https://decontaminationcovid19.com/wp-content/plugins/ultimate-elementor/compatibility/modules/73XtsqnqdwHAQp.phpiSNu
    • https://ottomanbilisim.com/include/modules/projeler/main/kat/J5EhdxpwdN8O.phpplM9lD4|v
    • https://gettingreadytolearn.co.uk/portal/wall/posts/157/thumbs/BeAsmBuB.php&cNrW&cNrW

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas
8e9026f5ed0f38efd4b1eb5ad8923c9c5391eb7dd787162b01a567e51cf3a37c		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 142082 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.