Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 233233a29852d267…

MALICIOUS

Office (OLE)

395.5 KB Created: 2020-03-31 21:14:15 Authoring application: Microsoft Excel First seen: 2020-08-25
MD5: b6f562734fbe3d065a56fb3e0ca6ec8e SHA-1: 43dd1dd5d8e08584e3ff769477c5b7fda0c61483 SHA-256: 233233a29852d26734f788382b32c15cf5c281ad4247dd4d7b63b89a6a2600c4
100 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic

The sample is an Excel file identified as containing encrypted Excel 4.0 macros, a common technique for obfuscating malicious code. The presence of multiple macro sheets and an 'AUTOOPEN' macro suggests an intent to automatically execute code upon opening. While no specific URLs or scripts were extracted, the heuristics strongly indicate a downloader or droppper functionality.

Heuristics 3

  • OLE metadata lists many Excel 4.0 macro sheets high 2 related findings OLE_XLM_DOCPROPS_MACROSHEET_INVENTORY
    Workbook contains a BIFF Excel 4.0 macro-sheet marker and its clear OLE DocumentSummaryInformation stream lists many MacroN sheet titles. This is a useful static signal when FILEPASS encryption prevents formula extraction from the workbook stream.
  • Encrypted Excel 4.0 macro sheet high OLE_XLM_ENCRYPTED_MACROSHEET
    Workbook contains an Excel 4.0 macro sheet and BIFF FILEPASS encryption. Password-protected XLM macro sheets, especially the default Excel password path, are a common malware evasion pattern because static formula extraction may fail until the workbook is decrypted.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Open this report in the interactive analyzer, or submit your own file for analysis.