Office (OLE) / .XLS malware analysis — malicious · 29cc0755ba608448

MALICIOUS

Office (OLE) / .XLS

49.5 KB Created: 2023-02-14 15:57:41 Authoring application: Microsoft Excel First seen: 2023-02-16

MD5: 8bde819d2e44474197ede1ff0abc4ea8 SHA-1: 6dc32706dcf201b5f2af249914640e8a3b3a512a SHA-256: 29cc0755ba608448ac6ac6585b1ca7896aae4aee8b21ac5cefd262273081e70e

248 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1105 Ingress Tool Transfer T1071.001 Web Protocols

The VBA macro contains calls to URLDownloadToFileA and Shell(), indicating it is designed to download and execute a second-stage payload. The script constructs a path for the downloaded file using Environ$("USERPROFILE") & "\Documents\" and a random filename, saving it as a .raw file. The use of Shell() suggests execution of the downloaded content.

Heuristics 6

Reference to URLDownloadToFile API critical SC_STR_URLDOWNLOAD

Reference to URLDownloadToFile API
Shell() call in VBA critical OLE_VBA_SHELL

Shell() call in VBA
URLDownloadToFile in VBA critical OLE_VBA_DOWNLOAD

URLDownloadToFile in VBA
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code
Environ() call (env variable access) low OLE_VBA_ENVIRON

Environ() call (env variable access)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `dbb512f6efb57a79eca75ed7d4104342024e7e0f158f69323d6a81ce340d82c4`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	2224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.