Office (OLE) / .XLS malware analysis — malicious · 1ce547570c97a067

MALICIOUS

Office (OLE) / .XLS

399.5 KB Created: 2016-11-08 08:33:09 Authoring application: Microsoft Excel First seen: 2022-08-01

MD5: e88adab7dc05a1e709753015abb2ef55 SHA-1: 5bd756170ee121066bd28ef04abf7442e2be6c63 SHA-256: 1ce547570c97a067993cf1cc967477da30278f5ba1c883dcc18ac0b8dac19a33

228 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1059.001 PowerShell T1140 Deobfuscate/Decode Files or Information T1204.002 Malicious File

The Excel file contains VBA macros that utilize WScript.Shell to execute commands. The macro decodes a Base64 string from the 'Final Offer' worksheet and saves it as 'nvidiax.exe' in the temporary directory, which is then likely executed. This indicates a downloader or dropper functionality.

Heuristics 6

Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
WScript.Shell usage critical OLE_VBA_WSCRIPT

WScript.Shell usage
Reference to Windows Script Host high SC_STR_WSCRIPT

Reference to Windows Script Host
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `54ba713ab254cfd6176a4b8846c3b0962e2e7a2f34b5c1107ba20bf283bf1595`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	7094 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.