Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 196588a7404c90ab…

MALICIOUS

Office (OLE) / .XLS

86.5 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel
MD5: b43d8b40f9ef15965d0ff901e30c2f32 SHA-1: 3c0d89ac4b439b7cf60b6cc6e4195a8ce3514572 SHA-256: 196588a7404c90ab92502926afa24fbb25bf67c0ad50dba4f7ff4f1937816dda
160 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel spreadsheet containing Excel 4.0 (XLM) macros, indicated by multiple critical heuristic firings including the presence of an Auto_Open defined name and the use of dangerous formula APIs. The VBA macro code attempts to construct a URL using string concatenation, suggesting it is designed to download and execute a secondary payload. The specific URL constructed is 'https://sherpa'.

Heuristics 4

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • VBA macros detected medium OLE_VBA_MACROS
    Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
75a9e6bec3c3ded9c8444449e178f875bee349d4b5ab3b40d3d81a538517cc62		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 7645 bytes
macros.bas
9bb141ef6a4d7d73eb46d8bd845a370e4e0ca1ce7078acac29f87d53b7013018		 vba-macro oletools.olevba.extract_macros (decoded VBA source) 5597 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.