Malicious Office (OLE) / .XLS — malware analysis report

Static analysis result for SHA-256 1afcead689283994…

MALICIOUS

Office (OLE) / .XLS

67.5 KB Created: 2020-09-20 21:17:44
MD5: 44a7098c2e0e1c520fbea4c62bd8091a SHA-1: b1a8db185c7ea93cff8fd3c1b29d08b28e8cc662 SHA-256: 1afcead689283994df916a233d94298b2a8a94e3ed11c2c1edb932c210ac66f6
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059.001 PowerShell

The file contains Excel 4.0 macros, indicated by the OLE_XLM_AUTOOPEN heuristic. The OLE_XLM_DANGEROUS_FN heuristic specifically flags the use of the RUN API, which is commonly used to execute arbitrary commands. The SE_LOLBIN_RUN_COMMAND heuristic further confirms the presence of instructions for executing Windows command-line tools. While the embedded URL is marked as benign, the macro's ability to execute commands suggests it's designed to download and run a malicious payload.

Heuristics 4

  • XLM Auto_Open with dangerous formula APIs high OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tinyurl.com/y2lwkgdg

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt
9070c9b271065287fa003bfc349b4ed404b4d1f6d9c5a29550594602847cd30c		 xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 1023 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.