Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 1cd2afeef6bd3271…

MALICIOUS

Office (OLE)

35.5 KB Created: 2020-11-25 10:46:53 Authoring application: Microsoft Excel First seen: 2021-10-05
MD5: 0182ade19fb7943701c4d3200e3ff31e SHA-1: b0ab4468ed76eb49aa96f26c20f970d6e230c6ad SHA-256: 1cd2afeef6bd327164a412a7775042a936e87be7fe038b0e87bc2ca3ed0a4419
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel document containing Excel 4.0 (XLM) macros, indicated by the OLE_XLM_AUTOOPEN and OLE_XLM_DANGEROUS_FN heuristics. The presence of an Auto_Open entry suggests that the macro will execute automatically upon opening the document. The dangerous formula APIs used in the macro indicate it's designed to perform malicious actions, such as downloading and executing a secondary payload.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6363 bytes
SHA-256: 9351e5ef920feee90be4467a0518bdbcc9946b64507918c9718501a7289bfc4f
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     13 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  ofKE
' 0018     23 LABEL : Cell Value, String Constant - aUMzYEWm len=0 
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!F145 
' 0018     21 LABEL : Cell Value, String Constant - DgqTPe len=0 
' 0018     24 LABEL : Cell Value, String Constant - doHNtRvZM len=0 
' 0018     23 LABEL : Cell Value, String Constant - eidhvUeX len=0 
' 0018     21 LABEL : Cell Value, String Constant - eqhYxh len=0 
' 0018     21 LABEL : Cell Value, String Constant - gXMeJF len=0 
' 0018     22 LABEL : Cell Value, String Constant - gYgHMMG len=0 
' 0018     22 LABEL : Cell Value, String Constant - LpoIBnf len=0 
' 0018     24 LABEL : Cell Value, String Constant - lVUzwaSDP len=0 
' 0018     25 LABEL : Cell Value, String Constant - mYEwAIljKV len=0 
' 0018     23 LABEL : Cell Value, String Constant - OBDDBipa len=0 
' 0018     24 LABEL : Cell Value, String Constant - PSjgaQhFC len=0 
' 0018     27 LABEL : Cell Value, String Constant - QdYUPsPvFKVd len=0 
' 0018     27 LABEL : Cell Value, String Constant - qktIpGqIKHuO len=0 
' 0018     22 LABEL : Cell Value, String Constant - RMRetVL len=0 
' 0018     27 LABEL : Cell Value, String Constant - tQOqKAacPHNK len=0 
' 0018     20 LABEL : Cell Value, String Constant - UdWaO len=0 
' 0018     21 LABEL : Cell Value, String Constant - VlHxqM len=0 
' 0018     24 LABEL : Cell Value, String Constant - WNPdNmEVn len=0 
' 0018     21 LABEL : Cell Value, String Constant - YwxZDR len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELS
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.