Office (OLE) / .XLS malware analysis — malicious · 1c90f739b96cfd6a

MALICIOUS

Office (OLE) / .XLS

811.5 KB Created: 2021-05-19 13:26:41 Authoring application: Microsoft Excel

MD5: a3770e810232a6e15b4fd36a444ef8d4 SHA-1: 8393744757072b7f65190678e54161864615a953 SHA-256: 1c90f739b96cfd6a5e1d3ca13eea94e28150e3eb7744d4865395df7f8c250a80

230 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Service Execution: Visual Basic T1059.003 Command and Scripting Interpreter: Windows Command Shell T1204.002 Malicious File: Malicious File

The sample contains a Workbook_Open VBA macro that uses CreateObject to execute a Windows script. This script likely downloads and executes a second-stage payload from one of the embedded URLs. The presence of the Workbook_Open macro and the CreateObject call strongly indicates a malicious intent to compromise the user's system.

Heuristics 8

Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — context-specific rules above attribute URLs they actually evaluated; this rule lists URLs that were present in the bytes but were not otherwise tied to a specific finding.
URL https://lojamusic.com.br/lojamusic.com.br/sitebuilder/IWu1s3chQoaXq.php
- https://langgal.coop.np/0KafeflIy.php
- https://euro-office.net/AwI3uwiwuU6.php
- https://euro-office.net/AwI3uwiwuU6.phpG
- https://lojamusic.com.br/lojamusic.com.br/sitebuilder/IWu1s3chQoaXq.php%
- https://samyberry.co.za/nlo6xegZx.php^b27Nv
- https://moayadcenter.com/rest/fonts/font-awesome/css/1y3BEJe50.phpLW;g3LW;g3LW;g3LW;g3LW;g3
- https://app.lead-concept.com��
- https://weeflow.com/wp-content/themes/twentyfourteen/genericons/font/B8Yj2bd8nrfXk5.php_2S,^EK�
- https://fotounirii.ro/wp-content/plugins/under-construction-page/themes/000webhost/EYZWDFGxTaDjbR.phpc3ZW;!=c3ZW;!=c3ZW;!=�
- https://specs2go.shawalzahid.com/wp-includes/sodium_compat/src/Core/Base64/gRC1QXli.php.-;4(�
- https://welcometotheafterdeath.com/pixelmon��
- https://app.lead-concept.com/ws/wSu6ZEPLdlxH7W8.phpYr@dNo(EZOkEJ5
- https://weeflow.com/wp-content/themes/twentyfourteen/genericons/font/B8Yj2bd8nrfXk5.php_2S,^EK
- https://welcometotheafterdeath.com/pixelmonkey.com.au/saeadventures/wp-includes/Text/Diff/0hDhEI2E.phpT7oHsT7oHs
- https://fotounirii.ro/wp-content/plugins/under-construction-page/themes/000webhost/EYZWDFGxTaDjbR.phpc3ZW;!=c3ZW;!=c3ZW;!=
- https://specs2go.shawalzahid.com/wp-includes/sodium_compat/src/Core/Base64/gRC1QXli.php.-;4(

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d81efa8ca8b9c35234eccc03f38f581caa992ccf4bcaa5190447f9d1f2230ab3`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	126951 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.