Office (OLE) / .XLS malware analysis — malicious · 19664fdea764b1e4

MALICIOUS

Office (OLE) / .XLS

215.0 KB Created: 2018-06-11 09:13:58 Authoring application: Excel Android

MD5: a9c12ad0ca0e929009609539dea391a1 SHA-1: 1d3b44e0282da0c4c74ee70082ad0356fd4d74d1 SHA-256: 19664fdea764b1e40a150d7101e819b73d8ce748cb9c6ece6319c3feb231ef38

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample is an Excel file containing obfuscated VBA macros, including an Auto_Open macro that uses Shell() and CreateObject() calls. This indicates an attempt to execute arbitrary code. The VBA code appears to be a loader that decodes and executes a payload, likely to download and run a second-stage exploit or malware. The document body, written in Ukrainian, presents a fake compensation notice and instructs the user to disable Excel's Protected View, further supporting a social engineering attack.

Heuristics 7

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER

Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `7faa61bd62e11ab83331f09a399d176590d2c29b571db581fc8214cc3108d7ca`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	783322 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1642 long base64-like blob(s).

Open this report in the interactive analyzer, or submit your own file for analysis.