Office (OLE) / .XLSX malware analysis — malicious · 1bef61e54cd18768

MALICIOUS

Office (OLE) / .XLSX

54.0 KB Created: 2006-09-16 00:00:00 Authoring application: Microsoft Excel

MD5: d0ad7c8cfd3effa944dce63ae39715ea SHA-1: 505d12ad5acdfbbf490e2942e8999c68c26f3704 SHA-256: 1bef61e54cd1876851c13d35c44f169a6575a9a79b70a4b65741ec8fa3e94976

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer

The file contains an encrypted Excel 4.0 macro sheet and VBA macros. The VBA script explicitly uses the URLDownloadToFile API to download a payload from a URL constructed by concatenating "http://" with a value from the "Files" sheet, Range("B60"). This indicates a downloader functionality, aiming to fetch and execute a second-stage malicious file. The specific URL is not fully reconstructible due to reliance on sheet data, but the download mechanism is clear.

Heuristics 5

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET

Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `0f1242a109be856c87ce725152fafb71b7f7fac0bbc68a186108f82d0b1a5db8`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.