Office (OLE) / .XLS malware analysis — malicious · 28ef3a391f1eb27d

MALICIOUS

Office (OLE) / .XLS

581.5 KB Created: 2001-04-12 21:22:26 Authoring application: Microsoft Excel

MD5: 2c095808477e5d54cda0efd85729d6e1 SHA-1: ec39fa8b5db2e12118e6fa3aa8e5a52b35aeb3d9 SHA-256: 28ef3a391f1eb27d7bec6efd6ccf57d2068db90a0a4af2eeef2ff5ea268d49f6

388 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The sample contains VBA macros, including Workbook_Open and Auto_Open, which are designed to execute automatically. Heuristics indicate the use of ShellExecute, CreateObject, and GetObject, suggesting the execution of external code or processes. The document body and heuristics point to social engineering lures, specifically prompting the user to install a browser extension/update or open a password-protected archive, which are common methods for delivering malware. No specific scripts were extracted for detailed analysis, but the presence of auto-executing macros and the nature of the lures strongly suggest a malicious intent to download and execute further payloads.

Heuristics 12

Reference to ShellExecute API high SC_STR_SHELLEXEC

Reference to ShellExecute API
Workbook_Open macro high OLE_VBA_WBOPEN

Workbook_Open macro
Auto_Open macro high OLE_VBA_AUTO

Auto_Open macro
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
GetObject call high OLE_VBA_GETOBJ

GetObject call
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://helpdesk.haltonhealthcare.on.ca/addmovechange/default.aspx
- http://www.everythingaccess.com
- http://helpdesk.haltonhealthcare.on.ca/addmovechange/order.aspx?TicketID=769
- http://helpdesk.haltonhealthcare.on.ca/addmovechange/completed.aspx?TicketID=
- http://schemas.microsoft.com/cdo/configuration/sendusing
- http://schemas.microsoft.com/cdo/configuration/smtpserver
- http://schemas.microsoft.com/cdo/configuration/smtpserverport
- http://www.google.ca
- http://www.ibm.com/
- http://www.google.com/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `8cdc4e59562ea7653027541214db958e17c6e472d9cbdadffd6da04769ad0fbf`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	142368 bytes
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 1 shell/COM execution token(s). Carved artifact contains 11 Chr/ChrW string-construction calls. Carved macro source contains an auto-exec entry point and execution/download terms.

Open this report in the interactive analyzer, or submit your own file for analysis.