Office (OLE) / .XLS malware analysis — malicious · 241244a63b1f4c6f

MALICIOUS

Office (OLE) / .XLS

75.0 KB Created: 2020-10-25 18:24:14 Authoring application: Microsoft Excel

MD5: 44a64ea80024e1a991c3e690cedfe61d SHA-1: 115fddab34e1be0377543155781cdd3a861d98cb SHA-256: 241244a63b1f4c6f6e797b82ff48b1a3823422fa12b9aca97bb06c441eed442a

140 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.002 Spearphishing Attachment

The sample is an Excel file containing both VBA and XLM macros. The XLM macro constructs and executes a PowerShell command to download a file named 'e5.exe' from 'https://cutt.ly/8gZSwUs'. It then moves the downloaded file to the user's AppData directory and executes it. The VBA macro 'auto_open' is designed to trigger the XLM macro. This indicates a downloader functionality aiming to execute a second-stage payload.

Heuristics 4

ClamAV: Xls.Malware.Abracadabra-10031695-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Abracadabra-10031695-0
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt` `fc051365d500144d21b0dcd2de5bba1f6334b13cdf55e9950274868568a6e669`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	1259 bytes
`macros.bas` `fee65a11429dc10585813f204465c30b1b3c2131639dcde641611baba3f7538f`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	830 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.