Office (OLE) / .XLS malware analysis — malicious · 2d4a68040636244e

MALICIOUS

Office (OLE) / .XLS

33.0 KB Created: 2015-06-05 18:17:20 Authoring application: Microsoft Excel First seen: 2022-10-17

MD5: 6a6dfa3372ae6b8d0e9fa9024f37af9e SHA-1: 96982f4735e46d13c42e7a74ceaa6bf389aacf14 SHA-256: 2d4a68040636244e5ebd896dbba1855cf45b0f937ed891ab8d538399e2c4a985

100 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell T1059.005 Visual Basic

The VBA macro contains obfuscated code that, when decoded, constructs and executes a PowerShell command. This command downloads a JavaScript file named 'notepad.js' from a hardcoded URL and executes it. The script also attempts to establish persistence by writing to the registry Run key.

Heuristics 3

Reference to PowerShell high SC_STR_POWERSHELL

Reference to PowerShell
CreateObject call high OLE_VBA_CREATEOBJ

CreateObject call
VBA macros detected medium OLE_VBA_MACROS

Document contains VBA macro code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`macros.bas` `322af7c803e27ad4fc33fc460ac0e1c0a97878b5cdc4b178fd8436203998bcab`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	1493 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.