Office (OLE) / .XLS malware analysis — malicious · 291a081e38d4d12a

MALICIOUS

Office (OLE) / .XLS

377.5 KB Created: 2020-11-24 22:48:52

MD5: a44f4a190009c6693931456977dd15f8 SHA-1: eeab923586eb77237c9a9e9ca110eb28f935c868 SHA-256: 291a081e38d4d12af7da73e4fafe9d2a9e001bc88e0f1a503037b7ffedcd4b68

200 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1204.002 Malicious File

The XLS file contains VBA macros that execute a PowerShell command. This command downloads an executable from 'sparepartiran.com' and then runs it. The embedded PowerShell command is a strong indicator of a downloader or droppper functionality, aiming to fetch and execute further malicious content.

Heuristics 6

ClamAV: Xls.Malware.Sagent-10035294-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Xls.Malware.Sagent-10035294-0
Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND

Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://sparepartiran.com/js/2Q/Bolgkwpzwqs8.exe

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `d8c08c571e433de26cf4d62506c6a4da98ef7829429b8bf051ae2bd98849e35d`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.